arsenal/kismet

kismet

wireless detector & IDS · GPL-2.0

A passive wireless detector, sniffer, and intrusion-detection system. Kismet listens without transmitting, maps every device and network in range, and logs it all for later analysis.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01Passive by design

Kismet is the opposite of an active scanner. It never sends a probe; it just listens to every frame in the air and builds a live picture of what is out there: access points, clients, the relationships between them, hidden SSIDs, and anomalies. That passivity is the point. For wardriving it means you can drive and record without touching a single network. For defence it means you can watch your own airspace and catch things that should not be there.

» Detects networks that are not beaconing their name (hidden SSIDs) by watching client traffic.

» Tracks clients as well as access points, so you see who is talking to what.

» Doubles as a wireless IDS: it raises alerts on deauth floods, spoofed APs, and known attack signatures.

» Logs everything to a database you can query, map, and feed into other tools.

02Install and add your card as a source

Install Kismet, then run it as your normal user, not root, after adding yourself to the kismet group. Kismet takes the card in monitor mode itself; you point it at your interface with -c (capture source).

$ sudo emerge net-wireless/kismet # Gentoo

$ sudo apt install kismet # Debian / Ubuntu / Kali

$ sudo dnf install kismet # Fedora

» You do not need to put the card in monitor mode first; Kismet handles that when it opens the source. Log out and back in once after the usermod so the group change takes effect.

03The web interface

Kismet's front end is a web UI, not the terminal. Once it is running, open a browser on the same machine. The first launch asks you to set an admin username and password, then you land on a live device list that updates as frames arrive.

$ xdg-open http://localhost:2501

» The main view sorts every detected device by signal, type, channel, and last-seen time. Click any access point to drill into its clients, its security, its signal history, and, if you have GPS running, where you saw it. This is where the picture comes together.

↑ contents

04Add GPS for wardriving

A detection without a location is just a name. Plug in a USB GPS puck, run gpsd, and Kismet stamps every observation with coordinates. Now your log is a map: every network with the strongest point you heard it from.

$ sudo apt install gpsd gpsd-clients

$ sudo gpsd /dev/ttyACM0 -F /var/run/gpsd.sock

$ cgps -s

» Once cgps shows a 3D fix, Kismet picks the GPS up automatically on its next start. Confirm it in the web UI; detected devices will gain a location field. See the wardriving guide for the full rig: antenna, mount, power, and route.

05Reading what Kismet finds

The device list is dense on purpose. A few columns tell you most of what matters, and learning to scan them quickly is the skill.

» Type: Wi-Fi AP, Wi-Fi Client, Bridged, or Bluetooth, so you can filter to just infrastructure.

» Crypt: the security in use; an Open or WEP row is an immediate flag on any network you are responsible for.

» Clients: how many devices are talking to an AP, which hints at what the network is for.

» Signal and Channel: for locating a device physically and for spotting two APs fighting over one channel.

» Manuf: the hardware vendor from the MAC, useful for recognising your own kit versus something unexpected.

» On your own network, the useful habit is to learn what normal looks like, every AP and client that should be there, so that anything new stands out the moment it appears.

06Kismet as a wireless IDS

Left running on your own site, Kismet watches for the very attacks the rest of this arsenal can perform. Its alerts surface in the web UI and in the log. This turns the tool from a wardriving recorder into a tripwire for your own airspace.

» DEAUTHFLOOD: a burst of deauthentication frames, the signature of the aircrack-ng or bettercap handshake-forcing step.

» APSPOOF: an access point advertising an SSID that does not match its expected BSSID, the mark of an evil twin.

» CRYPTODROP: a network that suddenly downgrades its encryption, which can signal a downgrade attack.

» PROBENOJOIN and others: unusual client behaviour worth a second look.

» If you run the aircrack-ng deauth step against your own network while Kismet watches, you will see this alert fire. That is the exercise: confirm your monitoring catches the attack you just simulated.

↑ contents

07Work with the logs afterwards

Every session writes a .kismet file, which is a SQLite database. Kismet ships helper tools to turn it into formats you can map or analyse. The most common for wardriving is Wigle CSV, which uploads straight to the wigle.net map.

$ kismetdb_to_wiglecsv --in Kismet-20261007-14-20-01-1.kismet --out drive.wiglecsv

$ kismetdb_statistics --in Kismet-20261007-14-20-01-1.kismet

» That CSV is the bridge to mapping. See the wardriving guide for turning a drive into a coverage map and for what to do with the picture once you have it.

08What to do with the picture

Kismet's output is only useful if it changes something. On your own estate, the findings translate directly into actions.

» Find every Open or WEP network you own and fix or retire it; there should be none.

» Spot rogue or unexpected APs advertising your SSID, the classic evil twin, and track them down by signal.

» Identify channel congestion where your own APs collide, and re-plan channels for cleaner coverage.

» Keep a baseline of known devices so a new client or AP is obvious the next time you listen.

» Leave Kismet running as a standing IDS in a sensitive location and review its alerts regularly.

The discipline that makes Kismet safe is also what makes it useful: listen to understand and defend your own airspace, never to reach into someone else's.

↑ contents