USB Truncation of URB_isochronous in frames
Summary
Isochronous In frames of a UAC2 (audio recording) stream are displayed and decoded at the payload size, not the size of the data-structure containing the frame. The frame as displayed and decoded is truncated by exactly the length of the driver-supplied frame header. The data payload is received complete by downstream applications such as Audacity.
I'm not sure if this is a bug in wireshark or usbmon. It's extremely similar to this fixed 2015 windows issue which was related to the capture driver: https://github.com/desowin/usbpcap/issues/21
Steps to reproduce
Capture a stereo audio recording from a USB2 UAC2 sound card using a usbmon tap on a Ubuntu machine.
For a 48KHz 32b 2ch card, the isochronous-in frame contains 8 chunks of sample-data of 72 bytes each. The samples occupy 48 bytes of each chunk, the remainder is padding. This frame contains 576 bytes of actual payload, all samples are recovered glitch-free downstream. The total displayed frame size in wireshark is 576 bytes, but this starts with 192 bytes of preamble, leaving the payload section 192 bytes short.
What is the current bug behavior?
The frame is displayed and decoded with only the number of bytes the payload alone should contain (576 bytes). Decode starts at the header provided by the capture driver, and stops 192 bytes short of a full decode. Payload starts in the frame at 0xC0 (192 bytes in)
What is the expected correct behavior?
The reported frame size should be 768 bytes (576+192), allowing for a full decode of both the header and the payload.
Sample capture file
In this capture, the left channel is counting up in 16 increments, with six samples at each increment.
This fills each data chunk with a single marker value, which increments between chunks.
Each frame contains 8 chunks. If data were lost at the frame boundary as wireshark suggests, it should appear as a glitch twice per ramp.
The problem frames are source=1.6.2 destination=host
Relevant logs and/or screenshots
In this screnshot, the ramps increment smoothly with the correct number of samples at each value, indicating no data loss.
Build information
Wireshark
3.2.3 (Git v3.2.3 packaged as 3.2.3-1)
Compiled (64-bit) with Qt 5.12.8, with libpcap, with POSIX capabilities (Linux), with libnl 3, with GLib 2.64.2, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.15.0, with Lua 5.2.4, with GnuTLS 3.6.13 and PKCS #11 (closed) support, with Gcrypt 1.8.5, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.40.0, with brotli, with LZ4, with Zstandard, with Snappy, with libxml2 2.9.10, with QtMultimedia, without automatic updates, with SpeexDSP (using system library), with SBC, with SpanDSP, without bcg729.
Running on Linux 5.4.0-105-generic, with Intel(R) Core(TM) i7-8565U CPU @ 1.80GHz (with SSE4.2), with 15729 MB of physical memory, with locale en_AU.UTF-8, with light display mode, without HiDPI, with libpcap version 1.9.1 (with TPACKET_V3), with GnuTLS 3.6.13, with Gcrypt 1.8.5, with brotli 1.0.7, with zlib 1.2.11, binary plugins supported (18 loaded).
Built using gcc 9.3.0.
usbmon
name: usbmon vermagic: 5.4.0-105-generic SMP mod_unload modversions