cynthion-pcap-decode

Run decode.py with the capture path to get JSON output, or add --format transcript or --format markdown for human-readable views. It uses tshark's usbll dissector by default and falls back to a native Python parser if tshark is unavailable.

Run diff.py with the two capture files to align transactions by address, endpoint, and sequence position. It reports transactions only in one capture and byte-level payload changes, with optional --endpoint, --address, and --control-only filters.

Packetry writes LINKTYPE_USB_2_0 (link type 288), raw wire-level USB 2.0 packets, while dpkt and many scapy USB paths expect LINKTYPE_USB_LINUX (220, usbmon format). They silently misparse or crash, so use this decoder or tshark's usbll dissector.

Yes, a native Python fallback using only the standard library handles packets, transactions, transfers, and standard descriptors, and can be forced with --native. It is best-effort, so tshark is recommended for anything beyond a smoke test.

No, Cynthion captures USB 2.0 (HS/FS/LS) only. USB 3.x devices may fall back to USB 2.0 when connected through Cynthion, and the decoder handles that resulting traffic correctly.