Kismet

Kismet is an open source application that provides users with an 802.11 layer2 wireless network sniffer, detector, and intrusion detection solution for Linux, BSD, Microsoft Windows and Mac OS X operating systems.

The application runs in any terminal emulator and features a client/server modular architecture that supports any wireless card that included raw monitoring (rfmon) mode. It is basically a command-line 802.11 b/g/n/a network traffic sniffer.

It has been designed from the ground up to be able to identify networks simply by detecting standard named networks and passively collecting packets. It can also detect hidden Wi-Fi networks, and discovers existing non beaconing wireless networks through data traffic.

Features at a glance

Key features include the ability to sniff 802.11b, 802.11g, 802.11n and 802.11a wireless networks, support standard PCAP file logging from Wireshark, Tcpdump, and other similar tools, runtime WEP (Wired Equivalent Privacy) decoding, and hidden SSID (Service Set Identification) decloaking.

In addition, the application supports channel and multi-card hopping, integration with third-party tool thanks to its internal XML-based logging functionality, real time export of network packets through built-in Tun/Tap virtual network interface drivers, and distributed remote Wi-Fi sniffing with drones.

Getting started with Kismet

When running the application for the first time, it will ask users if they want to automatically launch and connect to the Kismet server, or if they want to connect to a remote server. It is also possible to enable or disable logging before starting the server.

The command-line interface is easy to use and lets users to sort networks by type, channel, encryption, first/last seen (descending or ascending), BSSID, SSID, signal, and packets (ascending or descending).

Different view modes are providing under the View menu, including network list, client list, GPS data, battery, general info, status, packet graph, as well as source info. In addition, you can view channel and GPS details or alerts directly from the Windows menu.

What is new in this release:

• Somehow the latest configure script didn't get into the R1 release so it blew up on libnl1 detection; No code changes, no package changes.

What is new in version 2010-07-R1:

• Enhancements: Ruby interface and examples Proper TCP Async (for large numbers of drones and other situations) Add hidedata= option for "safer" sniffing in public environments Kluged escape handler for broken ncurses arrow handling on some systems Add --no-root option for zero-priv drone-only deploys
• Bugfixes: Fix installation on Ubuntu dash IPC updates and fixes for drone IPC architectural fixes

What is new in version 2010-01-R1:

• Includes fixes to segfaults, compiling problems on Snow Leopard, GPS, and sundry other quirks, and enhancements to the UI, support for the new GPSD JSON-only protocol, and a BT scanning plugin for BT device discovery.

What is new in version 2009-11-R1:

• Release includes fixes to crashes on resizing terminals, tweaks to plugins, addition of the autowep plugin, improved plugin handling, plugin support on OSX, initial support for Snow Leopard, fixes to PPI corruption, XML fixes, and quite a lot of other bugfixes.

What is new in version 2009-06-R1:

• Lots of fixes in this one (including dropping the 'candidate' designation).