I can see that the rest of the bytes change to something non-zero when moving the pointer around, Down could also be 255 when scrolling down, if the field was unsigned, Here it’s also easy to see what’s going on: the fourth byte is 1 (in decimal) when scrolling upĪnd -1 when scrolling down. When I scroll the mouse, without doing anything else, I see: Therefore contains the state of 8 buttons. So it easy to see what’s going on here: a button is represented as one bit. Holding in two buttons at the same time yields: They don’t seem change anything related to Reporting frequency internally when using these buttons. Nothing is sent when the mouse sensitivity buttons are clicked. Pressing only one button, one by one, yields: Mainly interested in two things: capturing button presses and capturing mouse movements. USB is usually little endian, by the way.Īt this stage I’ll try to reverse engineer the mouse data without looking at the specification. The filter I use in the screenshot will filter out the ack reports, as The host will send an ack report for each report it receives from theĭevice, back to the device. I had 1.2.1 in the first screenshotĪnd 1.7.1 in the second. The source name seems to vary between captures. The packets are called reports when using HID (described below). The packets that goes from the mouse to the computer: Wireshark doesn’tĭissect it, so that’s what I want to write a dissector for. “Leftover Capture Data” is the application layer and what I consider interesting. This shows all USB traffic, including the keyboard and anything else that is using USB. If it’s installed correctly it should look like this when capturing on the USB We have to install USBPCap on Windows, or use usbmon on Linux, in order to sniff USB traffic in

It has an introduction to Lua and creating Lua dissectors in general. If you are trying to use this blog post as a tutorial, you should first take a look at the blog post Two buttons for adjusting mouse sensitivity. It has two ordinary buttons,Ī scroll wheel that also doubles as the third button, backward/forward buttons, a “switch button” and In this post I’ll try to create a dissector for my Logitech MX518 mouse. Wireshark can also sniff USB traffic, so I thought it would be interesting to take a look The dissector I made back then was for a network With creating Wireshark dissectors in Lua.

Tutoriel wireshark linux