Currently, packet data is truncated to 256 bytes in pcap files. The original length is recorded, but the actual data is discarded. This shows up in Wireshark as "bytes captured" being smaller than "bytes on wire".
This is because DATA_LEN is used to limit the maximum pcap size. I'm not sure why 256 was initially picked. There are several sources that report 1024 as the maximum size of a USB packet, so that seems like a reasonable thing to set it to. It also might be reasonable to allow the value to be configurable. I have opted not to do this, since it's more complex, and there does not seem to be a significant downside to increasing it to the maximum, other than the potential increase in size of the pcap files, which is a tradeoff that people capturing pcaps are likely to want to make. Signed-off-by: Wesley Aptekar-Cassels <[email protected]> --- hw/usb/pcap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/usb/pcap.c b/hw/usb/pcap.c index dbff00be25..86eb603b5b 100644 --- a/hw/usb/pcap.c +++ b/hw/usb/pcap.c @@ -70,7 +70,7 @@ struct usbmon_packet { /* ------------------------------------------------------------------------ */ #define CTRL_LEN 4096 -#define DATA_LEN 256 +#define DATA_LEN 1024 static int usbmon_status(USBPacket *p) { -- 2.50.1
