How to record a USB packet capture for libobsbot

The protocol decode for any OBSBOT camera that libobsbot supports starts with a .pcapng file: USB traffic captured while OBSBOT's own software drives the camera. This page is the exact recipe per OS. When you have a file, attach it to a new-hardware issue and we'll do the protocol decode + Rust wiring.

What you need (all platforms)

• The OBSBOT camera plugged in via USB.
• Wireshark (with its CLI siblings dumpcap and tshark). The official installer ships every USB capture component you need.
• A piece of OBSBOT software to drive the camera while you capture - one API call per capture, ideally:
  • Linux: aaronsb/obsbot-camera-control (open source, links libdev.so). Build the obsbot-cli binary; its --interactive mode gives one-keystroke toggles for HDR and AI mode. For the controls the CLI doesn't expose, use tools/meet2-exercise in this repo - one API per invocation.
  • macOS or Windows: OBSBOT Studio (official, free). Touch one control at a time in its UI during the capture.

Linux

1. Enable usbmon

# One-time per boot. `run0` is the systemd equivalent of sudo.
sudo modprobe usbmon
sudo setfacl -m u:$USER:r /dev/usbmon*

2. Find the camera's bus + device number

lsusb | grep -i obsbot
# e.g. "Bus 003 Device 015: ID 3564:fefb Remo Tech Co., Ltd. OBSBOT Meet 2"
#       bus = 3, dev = 15

3. Capture during one operation

# Start the capture on the bus the camera is on. -q silences the
# packet-count chatter.
dumpcap -i usbmon3 -w /tmp/raw.pcapng -q &
sleep 1

# Drive ONE camera operation. Examples:
#   obsbot-cli --interactive    # then press h to enable HDR
#   ./meet2-exercise --set-wdr 1
#   ./meet2-exercise --set-fov 1

# Stop the capture.
kill -INT %1
wait

4. Filter to the camera and save

# Replace 15 with your camera's device number.
tshark -r /tmp/raw.pcapng \
  -Y 'usb.device_address == 15' \
  -w setWdr.pcapng
# <methodName>.pcapng is the convention; one per API call.

macOS

macOS doesn't have usbmon. Wireshark on macOS uses Apple's XHC* interfaces, which expose USB traffic per USB host controller. You need root to read them.

1. Install Wireshark and grant access

Install Wireshark from wireshark.org. During installation it asks whether to grant non-root capture access - say yes. If you skipped that:

sudo /Library/Application\ Support/Wireshark/ChmodBPF/ChmodBPF

2. Find the camera's host controller

system_profiler SPUSBDataType | grep -B 3 -A 8 -i obsbot

The output lists the camera under one of the USB host controllers (USB30Bus, USB31Bus, ...). The matching capture interface in Wireshark is XHC0, XHC1, XHC20, etc. on Intel Macs, or XHC{0,1,2,3} on Apple Silicon.

3. Capture during one operation

# List USB interfaces:
tshark -D | grep XHC
#   1. XHC0
#   2. XHC1
#   ...

# Capture on the right one:
sudo tshark -i XHC20 -w /tmp/raw.pcapng &
sleep 1

# Open OBSBOT Studio. Touch ONE control (e.g. HDR toggle). Wait a
# second to make sure the packets are flushed.

kill -INT %1
wait

4. Filter to the camera

The macOS capture format embeds USB endpoints differently from usbmon. Filter by vendor + product:

tshark -r /tmp/raw.pcapng \
  -Y 'usb.idVendor == 0x3564 && usb.idProduct == 0xfefb' \
  -w setWdr.pcapng
# Adjust idVendor / idProduct for your camera.

Windows

Windows captures use USBPcap, which the standard Wireshark installer bundles.

1. Install Wireshark + USBPcap

Download the Wireshark installer from wireshark.org and leave the USBPcap option ticked. Reboot when prompted (the USBPcap kernel driver needs it).

2. Find the camera's USBPcap interface

Open a PowerShell or Command Prompt:

"C:\Program Files\Wireshark\dumpcap.exe" -D
# Lists "USBPcap1", "USBPcap2", ... one per USB root hub.
# Plug the camera into a different port if you need to isolate which
# bus it's on; Device Manager shows the parent hub.

3. Capture during one operation

# Pick the USBPcap interface that owns the bus your camera is on.
"C:\Program Files\Wireshark\dumpcap.exe" -i USBPcap2 -w C:\Temp\raw.pcapng

# (Leave this running.) Touch ONE control in OBSBOT Studio.
# Ctrl-C to stop dumpcap.

4. Filter to the camera

"C:\Program Files\Wireshark\tshark.exe" -r C:\Temp\raw.pcapng `
  -Y "usb.idVendor == 0x3564 && usb.idProduct == 0xfefb" `
  -w C:\Temp\setWdr.pcapng

Naming and what to attach

Name files set<Method>.pcapng or get<Method>.pcapng based on the OBSBOT API name you drove (e.g. setWdr.pcapng, setFovU.pcapng). Capture each control as a separate file - cleanly isolated captures save us hours of decode work.

If your camera isn't on the hardware-support matrix, also include a descriptor dump:

# Linux
lsusb -v -d <vid>:<pid> > descriptors.txt
# macOS
system_profiler SPUSBDataType > descriptors.txt
# Windows
"C:\Program Files\Wireshark\dumpcap.exe" -i USBPcap2 -w C:\Temp\enum.pcapng
# (then plug the camera in while it's running - the enumeration shows
# every descriptor we need)

Attach the .pcapng (and descriptors.txt if applicable) to a new-hardware issue.