For those who have not looked at this before, debugfs is what lives in /sys/kernel/debug, and provides the more modern interface for usbmon access the old method via /dev/usbmonX is deprecated, and Wireshark will not even show up the ability to capture USB packets without debugfs. The first issue is that either OpenSuse or the kernel changed the way the debugfs is handled.

Let me start by explaining what the situation is, because there are two nearly separate issues at play here. I feel I’m close to another step on the evolution of my process, and once again it’s not because of me looking to improve the process as much as is the process not working on modern tools. The process evolution was not always intentional - in the case of USBlyzer, it was pretty much dead a few years after I started using it, plus the author refused to document the file format, and by then even my sacrificial laptop was not powerful enough to keep running all the tools I needed. Over the years, the way I capture USB packets to figure out a protocol changed significantly, starting from proprietary Windows-based sniffers, and more recently involving my own opensource trace tools. You could say that all of those that I successfully reversed up to now are USB based. The vast majority of the glucometer devices I reverse the protocol of use USB to connect to a computer.

Usbpcap wireshark windows