USB DeviceAddress

Hello,

I am using the USBPcap library to capture USB packets from selected devices.
When reading packets captured by the library we use the device address to do some filtering.

In some cases this adress changes and we endup capturing the wrong device.
After some research I found that this device address is set by Windows during device enumeration.

My question is: can Windows change this device address after it was set for the first time?
I know it might change during reboots, but once the device is conected and Windows is up can it change?

Thanks,

-George

but once the device is conected and Windows is up can it change?

This isn’t a “Windows” thing… it’s a USB specification thing.

The address is established during the connection/enumeration phase for the device (gad… I can’t remember the precise USB term for this… perhaps Mr. Roberts, who is usually up on all things USB will inform us). The address will only change if the device is logically or physically disconnected and re-connected.

As I always do, I have to ask: Why not use a “real” USB bus analyzer… one that plugs into the USB bus at the hardware level? They’re inexpensive… and I have learned never to trust the software trace tools.

Peter

Peter_Viscarola_(OSR) wrote:

> but once the device is conected and Windows is up can it change?
This isn’t a “Windows” thing… it’s a USB specification thing.

The address is established during the connection/enumeration phase for the device (gad… I can’t remember the precise USB term for this… perhaps Mr. Roberts, who is usually up on all things USB will inform us).

Enumeration is the correct term.  See?  You never forget.

The address will only change if the device is logically or physically disconnected and re-connected.

That is exactly correct.  If the device address changed, then something
must have caused the bus to trigger another enumeration.

> -----Original Message-----

From: Peter_Viscarola_(OSR) [mailto:osr+d290725-
s6030753@vanillacommunity.email]
Sent: Wednesday, October 24, 2018 9:35 PM
To: Michal_Vodicka
Subject: Re: [NTDEV] USB DeviceAddress

As I always do, I have to ask: Why not use a “real” USB bus analyzer… one
that plugs into the USB bus at the hardware level? They’re inexpensive…
and I have learned never to trust the software trace tools.

I just need one and the company complains about price… do you have some tip for inexpensive and still usable one? I used Ellisys 200 for years but I think we paid less than current basic price for professional edition then. I guess they tripled price, maybe more. Currently standard edition which is minimal usable for me costs 1600 Euro (not USD) which doesn’t seems like inexpensive for me.

Michal

Michal, having been recently comparing HW traces from an Ellisys to viewing data captured by a software trace (usbpcap on linux, but still viewing it in Wireshark) I’ll confirm Peter’s comments about not trusting software data. Not that it’s outright wrong, it’s just so incomplete; things happen in USB land that (for me) the software traces just can’t capture.

I agree that 1600 Euro on it’s is not cheap, but when you compare it to the prices that some other vendors (IE, CATC) charge it’s a drop in the bucket.

I love the Ellisys analyzers (though you do see the LeCroy/CATC a lot). Like a lot of electronics, the price in Euros seems to be the same numerical price as the price in USD. The Standard edition is currently US$1599 – which I don’t consider to be that expensive. When an MSDN Professional (CLOUD) subscription is US$800 per year, I consider the cost of the hardware analyzer to be a relative bargain.

Then again, getting Dan to approve a hardware purchase here at OSR doesn’t exactly require super-human effort. Though, he did draw the line at my purchasing a LeCroy PCIe x8 bus analyzer… the bastard made me borrow one instead.

Paul,

I completely agree hw analyzer is better than any software level trace, although I had cases when sw was useful, too. Because I could see IRPs/URBs and problem at software level. But if I have to choose, I’d definitely prefer hw one.

I’ve never liked CATC. Ridiculously expensive, logs hard to read, incompatible formats among their versions, annoying obstructions when I needed their sw just to see the log somebody else sent me… Ellisys was good and cheap, I had both 100 and 200 versions, but it isn’t cheap anymore.

Michal

> Like a lot of electronics, the price in Euros seems to be the same numerical price as

the price in USD.

Not only electronics…

The Standard edition is currently US$1599 – which I don’t
consider to be that expensive.

It isn’t a disaster but it isn’t so easy to explain it to people who approve it. OK, I just hoped you know about some really inexpensive one as Ellisys used to be in the past.

Michal

There are other analyzers besides Teledyne LeCroy and Ellisys, so if cost is a concern you might want to look at one of those smaller companies. What speed is your device? The slower the device, the cheaper the analyzer…

Also, if you are connected to an xHCI controller, hardware determines the device address. For EHCI, the driver does that.

Diane

> There are other analyzers besides Teledyne LeCroy and Ellisys, so if cost is a

concern you might want to look at one of those smaller companies. What
speed is your device? The slower the device, the cheaper the analyzer…

The current device is full speed so Beagle USB 12 should be sufficient but for the future it’d be better to have high speed analyzer. I found http://www.internationaltestinstruments.com/products/97-1480a-usb-20-protocol-analyzer.aspx which is really cheap. I already have some logs from it and they look usable. Software looks rather similar to Ellisys one. However, their web doesn’t look very maintained and previously my antivirus complained about it (now it doesn’t).

Any experience/recommendation with LeCroy and Ellisys alternatives?

Michal