Kismet - The Easy Tutorial

Kismet Introduction
Last Change : Mar 25 2008 english flag

Tool
Install
Ergonomy
Forum

Details What is Kismet ?
Screenshots
Prerequisites
Installation
Configurations
Platform
802.11 Protocol
Logs
Wireless & Security

English spelling not yet checked!

⚠️⚠️⚠️
Please check our website about
attractions in Western Switzerland !! (Please use english translation).

⚠️⚠️⚠️
Merci de consulter notre site sur les
activités à faire en Suisse romande !!

Kismet

Kismet is an open source wireless network analyzer running under the Linux, Unix and Mac OS X systems. It is able to detect any 802.11 a/b/g wireless networks around it. 802.11 a/b/g protocols are WLAN (Wireless Local Area Network) standards.

Kismet works with a lot of wireless cards supporting "monitor" mode. This mode captures packets without being able to associate in the same time with an access point and require privileges rights.
Kismet detects networks by passively sniffing providing it the advantages to discover the "hidden" wireless networks and being itself undetectable.

Netstumbler, another open source wireless sniffer but for Microsoft Windows, contrary to Kismet, actively search for networks around it by sending lots of "probe requests". Because of this, Netstumbler can be easily detected and cannot see hidden wireless networks.
Kismet is also able to capture data which is not the case for Netstumbler.

The kismet program is composed by a server called "kismet_server" and a client "kismet_client" which can connect to many servers.
Kismet is able to generate several types of logs such as "dump", "csv" or "xml" files.
Optionaly, it can be associated with a GPS device and the "gpsd" tool to draw the detected access points and wireless covering zones on maps such as the Google maps.
"Sox" and "Festival" can also be used to play audio alarms for network events and speak out network summary on discovery.

Some wireless keywords:

802.11:        Details
Set of standards including the 802.11 a/b/g/n protocols for WLAN (Wireless Local Area Network) and defining Wireless data.

802.11i:        Details
Wireless security standards.

AP (Access Point):
A device that acts as a communication hub for wireless users. The AP is usually connects to a wired network.
Companies like Cisco Systems, 3Com, Nortel or Proxim are examples of AP manufacturers for professional environments while companies like Netgear, Linksys and D-Link are leaders in small business and home environments.

Rogue AP:        Details
A rogue AP is an unauthorized access point. Its goal is to bypass the security checks on an internal network.

SSID: (Service Set IDentifier)        Details
The SSID refers to a wireless network name and is contained in a field in certain wireless management frames. SSID is sometime called ESSID (Extend Service Set IDentifier).

BSSID: (Basic Service Set Identifier)        Details
Access Point Physical or MAC address.

SSID cloaking:        Details
Indicates that the SSID broadcasting is disabled.

Beacon:        Details
Frames used to help wireless clients to identify nearby access points.

WEP (Wired Equivalent Privacy) / WPA (Wi-Fi Protected Access)        Details
Wireless security protocols. Note that WEP is known as unsecure.

802.1x        Details
Port-based network access control mechanism.

WPA-Enterprise / WPA-Personal        Details
Types of authentication.

Infrastructure / Ad-Hoc       Details
Types of wireless network.