Linux netlink1 kernel netlink 1.1 nlmon nlmon.ko: CONFIG_NLMON=m ip link add dev nlmon0 type nlmon ip link set dev nlmon0 up tcpdump -i nlmon0 -w nlmsg.pcap In netlink_filter_tap() add the protocol NETLINK_KOBJECT_UEVENT, then nlmon can catch USB uevent. 1.2 API netli