In order to sniff USB traffic on macOS, the XHC20 interface must be "brought up" by executing the following command:
sudo ifconfig XHC20 up
Many online tutorials also suggest to disable the interface after the sniffing is complete. This can be done by executing:
sudo ifconfig XHC20 down
My question is: can I leave the XHC20 interface "up" even when I'm not actively sniffing it?
What are the implications (performance, memory, security, etc.)?