<p>From time to time, I need to dump USB traffic under Windows, mostly to support hardware under Linux, so my primary goal is to produce dump files for protocol analysis.</p>

<p>For USB traffic, it seems that <a href="https://web.archive.org/web/20151218000528/http://www.pcausa.com/Utilities/UsbSnoop/default.htm" rel="noreferrer">SniffUsb</a> is the clear winner... It works under Windows&nbsp;XP (but <em>not</em> later) and has a much nicer GUI than earlier versions. It produces <em>huge</em> dump files, but everything is there.</p>

<p>However, my device is in fact a USB serial device, so I turned to <a href="http://technet.microsoft.com/en-us/sysinternals/bb896644.aspx" rel="noreferrer">Portmon</a> which can sniff serial port traffic without the USB overhead.</p>

Personally, I'd use
QEMU
or
KVM
and instrument their USB passthrough code, and then use
libusb
to prototype the replacement driver in user space (this latter bit I've done before;
writing USB device drivers in Python
is fun!).