GO KALI FREE

Kismet

Wireless Attacks

Intermediatelow risk

Kismet is a wireless network and device detector, sniffer, wardriving tool, and wireless IDS. It works passively with WiFi, Bluetooth, and other wireless protocols.

Installation

sudo apt install kismet

Basic Syntax

kismet

Quick Facts

Full Name
Kismet
License
GPL v2
Written In
C++
Platforms
Linux, macOS, Windows
Category
Wireless Detection
Detection Types
WiFi, Bluetooth, SDR
First Release
2002
Author
Dragorn (Mike Kershaw)

Tool Overview

Kismet is one of the oldest and most capable wireless network detection tools available. Unlike active scanners, Kismet operates passively by listening to wireless traffic without transmitting, making it ideal for stealth reconnaissance and network mapping.

It supports a wide range of wireless hardware including standard WiFi adapters, Bluetooth LE devices, and Software Defined Radio (SDR) platforms like the HackRF and RTL-SDR. Kismet can detect networks, devices, and clients across multiple wireless protocols simultaneously.

Modern Kismet features a browser-based server architecture that allows remote monitoring and data visualization through a web dashboard. It is the standard tool for wardriving, wireless intrusion detection, and wireless security research.

Common Commands

kismetStart Kismet with the web-based UI on default port 2501
kismet -c wlan0Start Kismet capturing from the wlan0 interface
kismet -c wlan0monCapture from a monitor-mode interface named wlan0mon
kismet -c wlan0:name=recon1Attach a source with a custom human-readable name
kismet -c wlan0:channel=6Lock the capture source to channel 6
kismet -c wlan0:channels="1,6,11"Restrict channel hopping to channels 1, 6, and 11
kismet -c wlan0:hop=falseDisable channel hopping and stay on the current channel
kismet -c wlan0:hoprate=5Set the channel hop rate to 5 hops per second
kismet -c wlan1 -c wlan2Attach multiple capture sources at once
kismet -t sitesurveySet the base title used for log files
kismet -p /root/kismet-logsWrite log files to a specific directory
kismet -nRun without logging (do not write any log files)
kismet --log-types kismet,pcapngChoose which log types to produce
kismet --daemonizeFork Kismet into the background as a daemon
kismet --override wardriveLaunch using the built-in wardrive configuration override

Step-by-Step Guide

  1. 1Start the background service from the command line
  2. 2Open a web browser and go to the local dashboard address
  3. 3Configure your wireless card to feed data into the application
  4. 4Watch the dashboard populate with live device identifiers
  5. 5Analyze the collected metadata or save the logs for later evaluation

Warnings

Use Cases

Wardriving

Map wireless networks and access points while moving through an area using GPS-tagged data collection.

Bluetooth Discovery

Detect and enumerate Bluetooth Low Energy devices in proximity for IoT security assessments.

SDR Signal Analysis

Capture and analyze signals from software-defined radio hardware for RF security research.

Wireless IDS

Monitor for rogue access points, deauthentication attacks, and unusual wireless activity on your network.

Packet Capture

Capture wireless packets for offline analysis and handshake extraction in PCAP format.

Network Reconnaissance

Passively discover hidden networks, non-beaconing access points, and associated clients.

Related Tools

Aircrack-ng

Wireless Attacks

Wifite

Wireless Attacks

Wireshark

Sniffing & Spoofing

Bettercap

Sniffing & Spoofing

Metasploit

Exploitation

Frequently Asked Questions

What is Kismet used for?

Kismet is a wireless network detector, sniffer, and intrusion detection system. It passively discovers networks and devices by capturing packets without transmitting, making it ideal for stealthy wireless reconnaissance and wardriving.

Does Kismet support Bluetooth?

Yes, Kismet supports Bluetooth Low Energy (BLE) device discovery and packet capture with compatible Bluetooth adapters, alongside traditional WiFi monitoring.

Can Kismet crack WiFi passwords?

No, Kismet is a passive detection and logging tool. It cannot crack encryption keys. Use Aircrack-ng or Wifite for cracking after capturing handshakes with Kismet.

Is Kismet legal to use?

Passive wireless monitoring is legal in most jurisdictions, but local laws vary. Active transmission or using collected data without authorization may be illegal. Check your local regulations.

How does Kismet perform passive monitoring?

Kismet operates by listening to wireless frames without transmitting any packets. It captures beacon frames, probe responses, data frames, and management frames to discover networks and devices without alerting targets or triggering intrusion detection systems.

Can Kismet capture packets for offline analysis?

Yes, Kismet captures all intercepted wireless packets and saves them in PCAP format. You can export these captures and analyze them with Wireshark, tcpdump, or other packet analysis tools for detailed protocol inspection.

How does Kismet detect wireless networks?

Kismet detects networks by passively monitoring beacon frames broadcast by access points and probe request/response exchanges between clients and APs. It can discover hidden networks that do not broadcast their SSID by observing client probe requests.

Does Kismet support GPS logging for wardriving?

Yes, Kismet integrates with GPS receivers to tag detected networks with geographic coordinates. This enables wardriving activities where you map wireless networks across physical locations using GPX export for mapping tools.

How do I configure alerts in Kismet?

Kismet provides configurable alerts through the web UI and configuration files. You can set alerts for new network detection, device appearance, signal strength changes, and security events like deauthentication attacks.

Can Kismet detect rogue access points and drones?

Yes, Kismet excels at detecting unauthorized access points and wireless devices. It can identify rogue APs by monitoring for new networks, and with appropriate hardware, it can detect drone communication signals and Bluetooth devices used in drone control.

Tags

#wireless-attacks

Output Explanation

The browser-based dashboard visualizes all intercepted signals, organizing them by access points, connected clients, and extraneous Bluetooth devices.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.