Wireshark-users: [Wireshark-users] USB sniffing / packet size
From: Yuval Levy <wireshark10@xxxxxxxxx>
Date: Thu, 21 Jan 2010 20:25:32 -0500
Hello there,

newbie here, trying to use Wireshark to sniff / rever^H^H^H^H^H debug USB 
communication between a SONY digital camera and a PC running Kubuntu Linux 
9.10.

after initial headaches / freezes due to the nVidia chipset of my first PC, I 
successfully sniffed some USB packets (mouse) with Wireshark (binary installed 
from Ubuntu's repository) on an Intel chipset / Atom motherboard.

I start wireshark from a Konsole window and run it as root (the only way I 
found to give it access to the interfaces).
 
When I turn the camera on, Wireshark shows some communication, then it 
segfaults after eight warnings that the "file contains a record that's not 
valid".

When rather than displaying on screen I try to save to file, the file is saved 
but I get an error message when I open it, saying that the capture file 
appears to be damaged or corrupt and a packet is 65584 bytes long, more than 
the maximum packet. I can see the data in the file though, just not the 
corrupt packets.

Is this normal/expected?

thanks for any pointers / help.

Yuv