USB Sniffer

This project is a USB 2.0 high speed (480mbps) capable bus capture device built from a low cost FPGA development board and USB 2.0 PHY evaluation board.

The FPGA development board is the miniSpartan6+, based around Xilinx Spartan 6 LX9 (there is also a LX25 version available), which has 32MB SDRAM, FTDI USB 2.0 interface, SPI Flash, SD card, 2 HDMI interfaces and numerous digital and analog I/O connections for expansion.

The USB 2.0 PHY interface is based on the SMSC/Microchip USB3300 which is a ULPI based high speed USB PHY.
The ‘USB3300 USB HS Board‘ evaluation board has both USB A and USB B mini connectors which are wired together, making it suited to constructing a cheap USB bus analyser from!

The miniSpartan6+ is available from https://www.scarabhardware.com/minispartan6 for $75 and USB3300 PHY board is available from http://www.waveshare.com/usb3300-usb-hs-board.htm for $9.

Features

  • Support HS (480mbps), FS (12mbps) and LS (1.5mbps) captures.
  • Supports continuous streaming, one shot and detects buffer overruns.
  • Dense logging format that is expanded on the host PC.
  • Filtering based on match or not match of device ID and/or endpoint
  • Filtering of SOF packets (which are every 125uS in HS USB, 1ms in FS USB).
  • 0.5uS timing resolution (HS) or 4uS timing resolution (FS/LS)
  • Supports dumping log to text format, binary format, or ITI’s .usb log format.

Hardware

First Attempt

The first attempt at wiring the USB3300 eval board to the miniSpartan6 resulted in periodic USB CRC errors being detected in the capture logs due to the signal integrity of the board to board connection.
The ULPI interface runs at 60MHz, so I shortened the connecting wires by fashioning a custom ribbon cable to improve things and now it works reliably.

Second Attempt

Some other open-source and commercial USB capture devices capture data at quite a low level, not needing to understand the USB protocol, but this doesn’t allow for various filtering options to be done without extracting the data from the FPGA to the host PC.

My approach is for the USB Sniffer FPGA to understand the various USB message types, optionally filter them out (for example SOF packets which are every 125uS in High Speed USB), and then store to memory in a very dense format.

Github Links
– minispartan6 project + client SW: Link

I developed all the RTL modules in Verilog required for this project:
– USB Sniffer: Link
– ULPI Wrapper: Link
– FTDI Async Bridge: Link
– SDRAM Controller: Link

Software
The host SW can dump and decode USB transfers to a text file, e.g.

PING Device 18 Endpoint 2
ACK
OUT Device 18 Endpoint 2
DATA0: Length 31
55 53 42 43 05 06 00 00 00 00 00 00 00 00 06 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CRC = 43bb
NYET

It also produces logs that are understood by Vincent Pelletier’s open source ITI1480A-Linux tools (https://github.com/vpelletier/ITI1480A-linux – iti1480a-display).

USB Capture

It may also work with ITI’s Windows GUI but if you want to use their SW, you should buy their USB Analyser product!

Future Improvements
Currently, the USB capture is staged in the FPGAs internal block RAM (64KB on the LX9), and then pulled via the FTDI USB connection on the miniSpartan6 to the host PC.
If the captured data comes in faster than it can be pulled out of the internal RAM, the capture will stop (buffer overruns are detected to avoid corruption).

The miniSpartan6+ has 32MB of SDRAM which I’ve already produced a working but basic SDRAM controller for (LINK), so I will add the option to dump to a larger buffer on the device in the future. This will make the implementation more resistant to large bursty USB transfers that would otherwise overwhelm the internal memory and FTDI interfaces ability to get rid of the data to the host PC.