HID Monitor
HID (Human Interface Devices) encompass a broad range of devices that facilitate interaction between humans and machines. While commonly associated with keyboards, mice, and controllers, HID technology extends to devices like card readers, LEDs, and telephony equipment. The HID Monitor plugin simplifies USB-based HID development by capturing and inspecting all HID reports exchanged between HID devices and a workstation. This capability is invaluable for debugging and refining HID peripherals, offering developers insights into data transmission and device behavior.
Basic Setup
Ensure USBPcap is installed if you are on Windows, or that usbmon is enabled if you are on Linux.
Note
On Windows, HID Monitor requires the USBPcap
capture driver. USBPcap
is bundled with the full IO Ninja .msi
installers, so if you installed IO Ninja this way, you are set. However, if you installed IO Ninja from a core .msi
installer or a portable .7z
package, you must install USBPcap from its official website manually.
On Linux, HID Monitor depends on usbmon
, therefore you need to manually enable it to use the plugin.
In IO Ninja, click the “New Session” dropdown and select a new “HID Monitor” session

From the “Device:” dropdown menu, select the HID device you want to monitor.

Click the “Capture” button, to the right of the device selection dropdown.

Analyze the log as HID traffic is intercepted.

Adjust settings as needed via the “Settings” button (see “Settings” section below for details)
Settings

Setting |
Description |
Default |
---|---|---|
Device |
The HID device to be monitored. |
|
Snapshot size
(Windows-only)
|
The maximum size of a USB packet that can captured by the USBPcap driver. |
65536 |
Kernel buffer size |
Specify the USB monitor engine (usbmon or USBPcap) kernel buffer size (the amount of memory allocated in the kernel for storing captured packets before they are processed). |
1MB |
Read block size (B) |
The size of each individual read block submitted to the underlying transport. |
4KB |
RX buffer size (B) |
The full size of the incoming data (RX) buffer. Affects read throughput. |
16KB |
RX buffer full notifications |
Toggle warnings in log about the incoming data (RX) buffer getting full. |
off |
FAQ (Frequently Asked Questions)
1. Why are no devices listed in the dropdown menu?
If the device list is empty, it’s likely due to USBPcap
(on Windows) or usbmon
(on Linux) not being properly installed or initialized. Ensure that you have installed USBPcap
or usbmon
correctly and, importantly, that you’ve rebooted your system after installation. Without a reboot, the necessary drivers may not be fully operational, leading to empty device enumerations.