> For the complete documentation index, see [llms.txt](https://gcf.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gcf.gitbook.io/notes/forensics/pcaps-analysis/usb-keyboard-pcap-analysis.md). # USB Keyboard pcap analysis If you have a pcap of a USB connection with a lot of Interruptions probably it is a USB Keyboard connection. A wireshark filter like this could be useful: `usb.transfer_type == 0x01 and frame.len == 35 and !(usb.capdata == 00:00:00:00:00:00:00:00)` It could be important to know that the data that starts with "02" is pressed using shift. You can read more information and find some scripts about how to analyse this in: * *