Create usbmon capture
|Captured traffic usually contains sensitive data like phone numbers - don't just upload it to public bug reports without reviewing what's in there!|
This article explains how to create usbmon captures with postmarketOS. One use case is capturing traffic between a USB attached modem inside the device (like the eg25-g in the PinePhone) to figure out modem related problems.
usbmon kernel module:
$ sudo modprobe usbmon
If it is not available for the kernel that your device uses, adjust your kernel config to enable
CONFIG_USB_MON, build the kernel on your PC and install it. Make a merge request to pmaports so it will be enabled for others in the future.
Find the USB bus
lsusb to figure out the relevant USB Bus ID. In this example, it is the bus
$ sudo apk add usbutils $ lsusb Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub Bus 002 Device 002: ID 2c7c:0125 Quectel Wireless Solutions Co., Ltd. EC25 LTE modem Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub Bus 005 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Find the interface
This guide uses
tcpdump to capture the traffic. Find the relevant interface first, in the example
$ sudo apk add tcpdump $ sudo tcpdump --list-interfaces 1.wlan0 [Up, Running, Wireless, Associated] 2.any (Pseudo-device that captures on all interfaces) [Up, Running] 3.lo [Up, Running, Loopback] 4.usb0 [Up, Disconnected] 5.usbmon5 (Raw USB traffic, bus number 5) 6.usbmon4 (Raw USB traffic, bus number 4) 7.usbmon3 (Raw USB traffic, bus number 3) 8.usbmon2 (Raw USB traffic, bus number 2) 9.usbmon1 (Raw USB traffic, bus number 1) 10.usbmon0 (Raw USB traffic, all USB buses) [none] 11.nflog (Linux netfilter log (NFLOG) interface) [none] 12.nfqueue (Linux netfilter queue (NFQUEUE) interface) [none] 13.wwan0 [none, Disconnected]
A convenient setup is running wireshark on your PC and have it analyze the traffic in real time. Enable SSH and configure it so you can login with your PC's SSH key as
root on your phone. Then run the following script on your PC to launch tcpdump over ssh, and pipe its output into wireshark. Once you run the command, you need to login via SSH first (e.g. type in the password of your SSH key). Afterwards the connection should be established, and whenever something happens on the USB, you should see related packages in wireshark.
#!/bin/sh -ex interface="usbmon2" host="192.168.1.82" ssh root@"$host" \ tcpdump -i "$interface" -s0 -w - -U \ | wireshark -k -S -i -
Depending on what you want to test, you might need to do a local capture instead. For example, when debugging problems related to suspending (where the application processor goes to sleep and the SSH connection would be lost).
Run this on your phone to do a local capture:
$ sudo tcpdump -i usbmon2 -s0 -w capture.pcap
To analyze the captured packages, view them in Wireshark.
If you have captured traffic of a modem speaking the Qualcomm MSM Interface (QMI) protocol (e.g. the eg25-g in the PinePhone), a dissector based on libqmi can be generated and used as follows:
$ git clone https://github.com/dnlplm/WiresharkQMIDissector $ git clone https://gitlab.freedesktop.org/mobile-broadband/libqmi.git $ cd WiresharkQMIDissector $ python3 generate_lua.py ../libqmi/data/ $ wireshark -X lua_script:qmi_dissector_gen.lua
QMI packets should show up as USB/QMI protocol now, and you can filter for "qmi" (e.g. with the display filter input).