Real-time USB class level decoding

1. A method of analyzing USB data, comprising:

receiving a first packet generated by a USB hardware analyzer configured to observe USB traffic associated with a target USB device that is being monitored, the first packet is associated with a USB class level operation associated with the target USB device, wherein a USB class level operation comprises a series of one or more USB transactions, each USB transaction comprises a prescribed sequence of USB packets defined by the USB class;

receiving a second packet generated by the USB hardware analyzer configured to observe USB traffic associated with the target USB device; and

determining that the USB class level operation has timed out based on a type of the second packet, wherein the type of the second packet is inconsistent with the first packet and the USB class level operation associated with the first packet.

2. The method of claim 1 , wherein the first packet is generated based on a first USB packet comprising a first portion of the USB traffic associated with the target USB device.

3. The method of claim 1 , wherein the second packet is generated based on a second USB packet comprising a second portion of the USB traffic associated with the target USB device.

4. The method of claim 1 , wherein the first packet associated with the USB class level operation comprises a first-received packet associated with the USB class level operation.

5. The method of claim 1 , wherein the second packet comprises a packet associated with the USB class level operation.

6. The method of claim 1 , wherein the second packet comprises a packet not associated with the USB class level operation.

7. The method of claim 1 , further comprising determining based at least in part on a time associated with one or both of the first packet and the second packet that the class level operation has timed out.

8. The method of claim 7 , further comprising determining based at least in part on a first time associated with the first packet and a second time associated with the second packet that the class level operation has timed out, including comparing a first timestamp associated with the first packet with a second timestamp associated with the second packet.

9. The method of claim 8 , further comprising comparing a difference between the second timestamp and the first timestamp against a predetermined time period associated with the class level operation.

10. The method of claim 1 , further comprising:

detecting a beginning of a class level operation and starting a timer in response to the detection; and

determining that the class level operation has timed out based at least in part on an expiration of the timer.

11. The method of claim 10 , wherein the time comprises a relative time.

12. An analysis system, comprising:

a communication interface configured to receive an analysis stream associated with a target USB device; and

a processor coupled to the communication interface and configured to:

receive via the communication interface a first packet generated by a USB hardware analyzer configured to observe USB traffic associated with a target USB device that is being monitored, the first packet is associated with a USB class level operation associated with the target USB device, wherein a USB class level operation comprises a series of one or more USB transactions, each USB transaction comprises a prescribed sequence of USB packets defined by the USB class;

receive via the communication interface a second packet generated by the USB hardware analyzer configured to observe USB traffic associated with the target USB device; and

determine that the USB class level operation has timed out based on a type of the second packet, wherein the type of the second packet is inconsistent with the first packet and the USB class level operation associated with the first packet.

13. The system of claim 12 , wherein the first packet is generated based on a first USB packet comprising a first portion of the USB traffic associated with the target USB device.

14. The system of claim 12 , wherein the second packet is generated based on a second USB packet comprising a second portion of the USB traffic associated with the target USB device.

15. The system of claim 12 , wherein the first packet associated with the USB class level operation comprises a first-received packet associated with the USB class level operation.

16. The system of claim 12 , wherein the second packet comprises a packet associated with the USB class level operation.

17. The system of claim 12 , wherein the second packet comprises a packet not associated with the USB class level operation.

18. The system of claim 12 , wherein the processor is configured to determine based at least in part on a time associated with one or both of the first packet and the second packet that the class level operation has timed out.

19. The system of claim 18 , wherein the processor is configured to determine based at least in part on a first time associated with the first packet and a second time associated with the second packet that the class level operation has timed out, including comparing a first timestamp associated with the first packet with a second timestamp associated with the second packet.

20. The system of claim 19 , wherein the processor is configured to compare a difference between the second timestamp and the first timestamp against a predetermined time period associated with the class level operation.

21. The system of claim 12 , wherein the processor is configured to:

detect a beginning of a class level operation and starting a timer in response to the detection; and

determine that the class level operation has timed out based at least in part on an expiration of the timer.

22. A computer program product for analyzing USB data, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

receiving a first packet generated by a USB hardware analyzer configured to observe USB traffic associated with a target USB device that is being monitored, the first packet is associated with a USB class level operation associated with the target USB device, wherein a USB class level operation comprises a series of one or more USB transactions, each USB transaction comprises a prescribed sequence of USB packets defined by the USB class;

receiving a second packet generated by the USB hardware analyzer; and

determining that the USB class level operation has timed out based on a type of the second packet, wherein the type of the second packet is inconsistent with the first packet and the USB class level operation associated with the first packet.

23. A method of analyzing USB data, comprising:

receiving a first packet generated by a USB hardware analyzer configured to observe USB traffic associated with a target USB device that is being monitored, the first packet is associated with a USB class level operation associated with the target USB device, wherein a USB class level operation comprises a series of one or more USB transactions, each USB transaction comprises a prescribed sequence of USB packets defined by the USB class;

receiving a second packet generated by the USB hardware analyzer configured to observe USB traffic associated with the target USB device;

detecting a beginning of the class level operation and recording a timestamp corresponding to the beginning of the class level operation; and

determining based at least in part on a time associated with one or both of the first packet and the second packet that the class level operation has timed out.

24. An analysis system, comprising:

a communication interface configured to receive an analysis stream associated with a target USB device; and

a processor coupled to the communication interface and configured to:

receive via the communication interface a first packet generated by a USB hardware analyzer configured to observe USB traffic associated with a target USB device that is being monitored, the first packet is associated with a USB class level operation associated with the target USB device, wherein a USB class level operation comprises a series of one or more USB transactions, each USB transaction comprises a prescribed sequence of USB packets defined by the USB class;

receive via the communication interface a second packet generated by a USB hardware analyzer configured to observe USB traffic associated with the target USB device;

detecting a beginning of the class level operation and recording a timestamp corresponding to the beginning of the class level operation; and

determining based at least in part on a time associated with one or both of the first packet and the second packet that the class level operation has timed out.