User Tools

Site Tools


howto:dumlcapture

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
howto:dumlcapture [2021/11/02 03:18]
czokie
howto:dumlcapture [2021/12/04 20:57] (current)
lawq Add m1 instructions
Line 1: Line 1:
-====== Capturing DUML ======+====== Capturing DUML - OSX ======
  
 Capturing DUML packets can be tricky if you are new to the scene. This page is designed to list some of the easy ways to capture DUML. It will grow over time as other people document other methods. Capturing DUML packets can be tricky if you are new to the scene. This page is designed to list some of the easy ways to capture DUML. It will grow over time as other people document other methods.
Line 7: Line 7:
 ==== 1. Disable SIP === ==== 1. Disable SIP ===
  
 +To capture DUML via the USB port, you need to capture data from an interface that is not normally accessible. Apple protects this interface to prevent key grabbers for example from capturing keyboard USB traffic. Once you are finished doing DUML capture work, you should re-enable SIP unless you are comfortable and understand the risks involved. The process to re-enable is the same as below, but change the word disable to enable.
 +
 +M1 Mac:
 +  * Shutdown your Mac
 +  * Hold the power button until "Loading startup options." appears.
 +  * Click options, enter your password for your user
 +  * Again, enter your password to enter "recovery" mode
 +  * Click Utility >> Terminal, type "csrutil disable", click Enter.
 +  * Restart your Mac
 +
 +Intel Mac:
   * Restart your Mac   * Restart your Mac
   * Hold down Command-R to reboot into Recovery Mode   * Hold down Command-R to reboot into Recovery Mode
-  * Click Utility->Terminal, type "csrutil disable", click Enter.+  * Click Utility >> Terminal, type "csrutil disable", click Enter.
   * Restart your Mac   * Restart your Mac
  
Line 15: Line 26:
  
   sudo ifconfig XHC20 up   sudo ifconfig XHC20 up
 +
 +NOTE: When not required for capturing, you should disable this interface using the following command.
 +
 +  sudo ifconfig XHC20 down
  
 ==== 3. Capture ==== ==== 3. Capture ====
Line 49: Line 64:
   rm -rf mefisto   rm -rf mefisto
  
 +==== 3. Restart Wireshark and capture ====
 +Start a packet capture in Wireshark, from the XHC20 interface.
 +==== 4. Set a display filter ====
 +
 +  (frame.protocols == "usb" && usb.darwin.request_type == 1 && usb.bInterfaceClass == 0x0a && frame.len > 32)
 +
 +This filter is designed to capture all POSSIBLE dji_dumlv1 packets that were not matched with the dissector. If you find any packets, you should re-check previous steps to make sure the dissector is installed correctly and re-start Wireshark. Once you have tested, you can use the "real" packet filter
 +
 +  dji_dumlv1
 +
 +This filter will display ONLY matched valid dji_dumlv1 packets.
 +==== 5. Set display columns ====
 +
 +This is an optional step, but it will make it easier to read and interpret a DUML flow at a glance.
 +
 +  * Click Wireshark >> Preferences >> Appearance >> Columns
 +  * Configure to your requirements. The default layout is shown below.
 +{{:howto:preferences.png|}}
 +
 +However, this looks shows Phantom 3 specific data. Unless you have a phantom, you might need to change this to suit your drone. Alternatively, you can use the generic settings shown below.
 +
 +{{:howto:preferences_generic.png|}}
howto/dumlcapture.1635823091.txt.gz ยท Last modified: 2021/11/02 03:18 by czokie