The former are much more limited and are used to reduce the size of a raw packet capture. The 'Leftover Capture Data' should contain the payload as described by one of the C structures.Capture filters (like tcp port 80) are not to be confused with display filters (like tcp.port = 80).

Now that you have a clear idea of the possible reports that may be flowing, you can go back to your Wireshark trace (still filtered on 'usb.request_in') and select 'URB_INTERRUPT in' packets. Uint8_t reportId // Report ID = 0x4D (77) 'M' LED Indicator Page outputReport 4B (Device Host) Uint8_t KB_KeyboardKeyboardRightGui : 1 // Usage 0x000700E7: Keyboard Right GUI, Value = 0 to 1 Uint8_t KB_KeyboardKeyboardRightAlt : 1 // Usage 0x000700E6: Keyboard Right Alt, Value = 0 to 1 Uint8_t KB_KeyboardKeyboardRightShift : 1 // Usage 0x000700E5: Keyboard Right Shift, Value = 0 to 1 Uint8_t KB_KeyboardKeyboardRightControl : 1 // Usage 0x000700E4: Keyboard Right Control, Value = 0 to 1 Uint8_t KB_KeyboardKeyboardLeftGui : 1 // Usage 0x000700E3: Keyboard Left GUI, Value = 0 to 1 Uint8_t KB_KeyboardKeyboardLeftAlt : 1 // Usage 0x000700E2: Keyboard Left Alt, Value = 0 to 1

Uint8_t KB_KeyboardKeyboardLeftShift : 1 // Usage 0x000700E1: Keyboard Left Shift, Value = 0 to 1

Uint8_t KB_KeyboardKeyboardLeftControl : 1 // Usage 0x000700E0: Keyboard Left Control, Value = 0 to 1 Uint8_t reportId // Report ID = 0x4B (75) 'K' Keyboard/Keypad Page inputReport 4B (Device -> Host) If you want to also decode the HID report descriptors then use the '-d' option. It will by default print the C-structures (see below). Now run the decoding software and paste the hex stream after the '-c' option. right-click the 'HID Report' and choose 'Copy' and '.as a Hex Stream'.select the 'GET DESCRIPTOR Response HID Report' packet.I wrote a bit of code a while back to help me decode HID report descriptors and to create C language structure definitions to describe each report.

Wireshark usb capture