Real-time USB class level decoding is disclosed. In some embodiments, a first packet associated with a USB class level operation associated with a target USB device that is being monitored is received. A second packet generated by a USB hardware analyzer configured to observe USB traffic associated with the target USB device is received. It is determined based at least in part on a time associated with one or both of the first packet and the second packet that the class level operation has timed out.