2.28. Capturing USB Traffic for Selected Devices

You can capture USB traffic for single USB devices or on the root hub level, which captures the traffic of all USB devices attached to the root hub. Oracle VM VirtualBox stores the traffic in a format which is compatible with Wireshark. To capture the traffic of a specific USB device it must be attached to the VM with VBoxManage using the following command:

VBoxManage controlvm "VM name" usbattach "device uuid|address" --capturefile "filename"

In order to enable capturing on the root hub use the following command while the VM is not running:

VBoxManage setextradata "VM name" \
  VBoxInternal/Devices/usb-ehci/0/LUN#0/Config/CaptureFilename "filename"

The command above enables capturing on the root hub attached to the EHCI controller. To enable it for the OHCI or XHCI controller replace usb-ehci with usb-ohci or usb-xhci respectively.