Extracting shutdown command from "sniffed" USB traffic

[ErikDB87]

In light of issue #2666, I "sniffed" USB traffic from APC's PowerChute Serial Shutdown software (with the help of this guide (https://www.youtube.com/watch?v=0MC-D_oNzbk)). I hope to be able to find out the shutdown command for my APC "Back-UPS BX750MI FW:295202G -302202G". APC's PowerChute Serial Shutdown software is able to shut the UPS down, so there must be a command, is my reasoning.

Any help on figuring this command out from the pcap files, is welcome! I haven't got the slightest idea on how to go about it...

I was able to generate two logs. The scenario was both initially the same: I unplugged the UPS from the electricity grid, and the PowerChute Serial Shutdown software started closing down my (Windows) laptop. Then I tried two scenarios:

• 2024-11-14-APC-BX750MI-1.pcap: I let everything run its course, and the UPS shut down, a little over a minute after my laptop had shut down completely (so maybe two minutes after initiating the process, as referenced on that forum I linked somewhere above?). I then plugged the UPS back in, and it restarted (of course).
• 2024-11-14-APC-BX750MI-2.pcap: As soon as Windows notified me of the shutdown that was going to occur, I plugged the UPS back in. I was pleasantly surprised that the same process as in scenario 1 happened, and the UPS power cycled.

The only caveat is of course that I don't know whether the PowerChute Serial Shutdown software shut down USBPcap prior to giving its final command - the holy grail - to the UPS... I don't think this is the case: I saw 2024-11-14-APC-BX750MI-2.pcap "growing" even after I plugged the UPS back in.

(I can't upload the log files, because they're not an allowed file type, so here's a link to a directory on my Google Drive, where they can be found: https://drive.google.com/drive/folders/12xLZH4YWJGXEjNETs2YBJix4boIUVDAE?usp=sharing.)

Thanks in advance to any and all! ;)

[ErikDB87]

I made another "sniff" log (2024-11-19-APC-BX750MI.pcap, via above mentioned link), this time with the setting that my Windows system would be shut down after 1 second of battery usage, and I unplugged the USB cable as soon as Windows notified me of the shutdown. That way I hoped to keep the log file shorter, and the shutdown command as close to the end of it as possible. The output was still 712 entries long, though...