qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] hw/usb/pcap: Prevent truncation of USB data in pacp files.
@ 2025-11-26  4:07 Wesley Aptekar-Cassels
  0 siblings, 0 replies; only message in thread
From: Wesley Aptekar-Cassels @ 2025-11-26  4:07 UTC (permalink / raw)
  To: qemu-devel

Currently, packet data is truncated to 256 bytes in pcap files. The
original length is recorded, but the actual data is discarded. This
shows up in Wireshark as "bytes captured" being smaller than "bytes on
wire".

This is because DATA_LEN is used to limit the maximum pcap size.

I'm not sure why 256 was initially picked. There are several sources
that report 1024 as the maximum size of a USB packet, so that seems like
a reasonable thing to set it to.

It also might be reasonable to allow the value to be configurable. I
have opted not to do this, since it's more complex, and there does not
seem to be a significant downside to increasing it to the maximum, other
than the potential increase in size of the pcap files, which is a
tradeoff that people capturing pcaps are likely to want to make.

Signed-off-by: Wesley Aptekar-Cassels <me@wesleyac.com>
---
 hw/usb/pcap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/usb/pcap.c b/hw/usb/pcap.c
index dbff00be25..86eb603b5b 100644
--- a/hw/usb/pcap.c
+++ b/hw/usb/pcap.c
@@ -70,7 +70,7 @@ struct usbmon_packet {
 /* ------------------------------------------------------------------------ */
 
 #define CTRL_LEN                     4096
-#define DATA_LEN                     256
+#define DATA_LEN                     1024
 
 static int usbmon_status(USBPacket *p)
 {
-- 
2.50.1


^ permalink raw reply related	[flat|nested] only message in thread

only message in thread, other threads:[~2025-11-26 14:15 UTC | newest]

Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-26  4:07 [PATCH] hw/usb/pcap: Prevent truncation of USB data in pacp files Wesley Aptekar-Cassels

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).