Start network capture as soon as interface is up

A solution exists for Windows, using USBPcap, an open-source USB sniffer for Windows that is integrated with Wireshark. This uses the program USBPcapCMD.exe that is also installed by Wireshark.

The method is discussed in detail in the article USB Packet capture for Windows Tour, but here is a summary:

• Plug in the device and use USBPcapCMD.exe to identify the Root Hub that this device is connected to
• Unplug the device and stop USBPcapCMD.exe
• Run USBPcapCMD.exe again, select the Root Hub and define the output .pcap file
• Plug-in the device
• Press Ctrl+C to stop collecting data
• Start Wireshark and open the .pcap file to analyze it.

You may also do live capture in Wireshark by entering in a Command Prompt (cmd) run as Administrator a command similar to the following :

USBPcapCMD.exe -d \\.\USBPcap2 -o - | "C:\Program Files\Wireshark\Wireshark.exe" -k -i -