Explanation of the above example USBMON is not a sniffer It cannot look at the wire, only at higher levels USB frames and timing require specific hardware And USB is not a shared channel like Ethernet "S" means "Submit" and "C" means "Complete The software stack is a state machine Every submit must be followed by a complete, possible delayed "Co" is "control out", we also have "Bo", "Ii" etc "000:00" is endpoint 0 of device 0 (not enumerated yet) "036:00" is endpoint 0 of device 36 (after enumeration) "64 <" at the end of a submit line is the input buffer size The reply can be no bigger than that