usb-rea

You bought a liquid cooler with a little screen on it, or an RGB controller, or a mouse with adjustable DPI. It works fine, as long as you run the vendor's Windows app. On Linux it just sits there. Somewhere inside that app are a few bytes that set the fan speed, and nobody has written them down.

usb-rea is built to find those bytes. You click around in the vendor app while the USB traffic is captured, and you label what each click did. The tool compares the packets for each action, infers the protocol and writes an open-source Python driver, "with every conclusion linked to the exact packets that prove it," in the README's words.

Its author, Emir Mrkaljević, presents it as the step after Wireshark. Wireshark captures and dissects packets. usb-rea reads those captures and works out the command structure behind them.

Feed it a capture from usbmon on Linux or USBPcap on Windows, and you get a Markdown report and a standalone pyusb driver. It can also write a Wireshark dissector for the protocol it found, so later captures are easier to read. The same tools run as a plain command-line program or as an MCP server, which lets an AI assistant drive the analysis.

There's a concrete case to back this up. From captures of the NZXT Kraken X fan command, usb-rea recovered the bytes exactly as the liquidctl project sends them, and the generated driver produced identical packets for fan speeds it had never seen. It reports the same for the SteelSeries Rival 100 mouse, checked against the rivalcfg project, with the proof running in the repository's automated tests.

You don't need a device to try it. Install it with pip and run the built-in demo, which analyses a simulated fan controller.

usb-rea is MIT licensed, published on PyPI and needs Python 3.10 or newer. It's labelled alpha, at version 0.7.13 in November 2026, and has been validated on synthetic devices, protocols documented by liquidctl and rivalcfg, public Wireshark captures and one cooler capture a user shared. The repository only dates from October 2026 and has a single contributor, so treat it as early work.

It's a local tool. The device lookup is offline by default, with an optional online check. A short legal section argues that reverse engineering for interoperability is permitted under EU and US law and says the tool only analyses traffic from devices you own. That's the author's reading, not legal advice.

One more thing you'll notice. The README opens with a banner for the author's separate paid project, offered as a way to fund this one. The tool itself costs nothing.

If there's a USB device on your desk that Linux ignores, run the demo and see how far a capture gets you.