REAL-TIME USB CLASS LEVEL DECODING

Real-time USB class level decoding is disclosed. In some embodiments, a first packet associated with a USB class level operation and a second packet generated by a USB analyzer are received. It is determined based at least in part on a first time associated with the first packet and a second time associated with the second packet that the class level operation has timed out. In some embodiments, an enumeration record is copied from a buffer configured to store USB data associated with a target USB device to a storage location not in the buffer, based at least in part on an indication that the enumeration record as stored in the buffer may be overwritten. In some embodiments, USB data is displayed for analysis at least in part by grouping packets not likely to be of interest differently depending on whether class level decoding is enabled.