Using Kismet for Wireless Discovery

Introduction

Kismet has earned a reputation as a reliable Kismet wireless scanner for both WiFi and Bluetooth Low Energy (BLE) environments. Unlike many point‑and‑click tools, Kismet runs headless, captures raw frames, and presents them through a clean web interface. This article walks through the entire workflow: installing the software, configuring WiFi and BLE sources, navigating the web UI, exporting PCAP files, setting up alerts, and understanding why Kismet is often preferred for thorough site surveys.

2.4GHz WiFi channels that Kismet monitors (Wikimedia Commons)

What is Kismet?

Kismet is an open‑source network detector, packet sniffer, and intrusion detection system for 802.11, BLE, and other wireless protocols. It operates primarily at Layer 2 of the OSI model, allowing it to see every frame that passes the radio, even those that are not addressed to the host. This low‑level visibility makes it ideal for discovering hidden SSIDs, rogue access points, and BLE beacons that would otherwise stay invisible to higher‑level tools.

Installing Kismet

Installation varies by platform. On Debian‑based systems the command is:

sudo apt-get update && sudo apt-get install kismet

For Raspberry Pi OS, use the official repository to get the latest version. After installation, start the service with sudo systemctl start kismet and enable it at boot with sudo systemctl enable kismet. The default web UI listens on port 2501; you can reach it at http://localhost:2501 from any browser on the same network.

Configuring Sources

Kismet can ingest data from three main source types: native WiFi adapters, external capture files, and BLE radios. Each source is defined in /etc/kismet/kismet.conf under a source= line.

• WiFi adapters: Use a chipset that supports monitor mode (e.g., Atheros AR9271, Ralink RT3070). The configuration line looks like source=wifi0:wlan0.
• PCAP files: Useful for offline analysis. Example: source=pcap:/path/to/capture.pcap.
• BLE devices: Kismet can talk to a BLE dongle via BlueZ or to a dedicated scanner like the BLEShark Nano. The line source=ble0:hci0 enables BLE capture.

graph TD
  A[Kismet Core] --> B[Source Manager]
  B --> C[WiFi Adapter (monitor mode)]
  B --> D[BLE Radio (BlueZ or external)]
  B --> E[PCAP File Reader]
  C --> F[Capture 802.11 frames]
  D --> G[Capture BLE advertisements]
  E --> H[Read stored packets]
  F --> I[Feed frames to Decoder]
  G --> I
  H --> I
  I --> J[Store in SQLite DB]
  I --> K[Push to Web UI]

BLE Scanning with Kismet

BLE scanning is often overlooked in WiFi‑centric surveys, but it adds a layer of insight for IoT deployments. When a BLE source is active, Kismet logs advertising packets, connection attempts, and even GATT service UUIDs when they are broadcast. The BLEShark Nano, built around an ESP32‑C3, provides a compact, battery‑powered BLE scanner that can be placed in hard‑to‑reach locations. Pairing a BLEShark Nano with Kismet extends the coverage area and captures BLE traffic that a laptop’s built‑in adapter might miss.

Web UI Overview

The web UI is divided into several tabs:

• Devices: Lists every MAC address seen, with signal strength graphs and vendor lookup.
• Networks: Shows SSIDs, encryption type, channel, and associated clients.
• BLE: Displays beacons, their payloads, and proximity trends.
• Alerts: Summarizes triggered rules, such as new AP detection or rogue device appearance.
• Export: Allows on‑the‑fly PCAP download for any time window.

The UI updates in real time via WebSocket, so you can watch a live heat map of signal strength across the survey area. Filters let you focus on a single channel, vendor, or SSID pattern, which is handy when you need to isolate a specific network for troubleshooting.

Kismet running in terminal mode (Wikimedia Commons)

PCAP Export

Kismet stores raw frames in a SQLite database, but you can export any slice as a PCAP file for deeper analysis with Wireshark or specialized forensic tools. The export process is straightforward:

1. Navigate to the Export tab.
2. Select a time range or a specific device/network.
3. Choose the format (PCAP or PCAPNG) and click Download.

Because Kismet captures at Layer 2, the exported PCAP contains the full 802.11 header, which Wireshark can decode into management, control, and data frames. This level of detail is essential when you need to verify handshake captures or investigate malformed frames that could indicate a rogue AP.

Alerts and Notifications

Kismet’s alert engine uses a rule‑based system defined in kismet_alerts.conf. Common rules include:

• New SSID detection on a previously quiet channel.
• Signal strength spikes that may indicate a moving device.
• BLE beacon appearance that matches a known asset list.
• Deauthentication frame detection (disabled by default in EU mode).

When an alert fires, Kismet can send an email, post to a Slack webhook, or write to a syslog. This flexibility lets you integrate wireless monitoring into existing security operations.

Kismet vs Wireshark

Both tools are indispensable, but they serve different purposes. Kismet wireless scanner excels at continuous, passive discovery across multiple radios. It aggregates data, correlates devices, and presents a high‑level view that is perfect for site surveys. Wireshark, on the other hand, is a packet‑level analyzer that shines when you need to dissect a specific frame or protocol stack.

In a typical workflow, you would run Kismet to map the environment, export a PCAP of a suspicious event, and then open that file in Wireshark for deep inspection. This complementary approach leverages the strengths of each tool without redundancy.

Comprehensive Site Surveys

When conducting a site survey, you need to answer three questions:

1. What wireless networks exist?
2. Where are the strongest signals and dead zones?
3. Which BLE devices are present and how do they move?

Kismet automates all three. By placing a laptop with a high‑gain antenna at several points and supplementing it with a BLEShark Nano in each zone, you can collect a unified dataset. After the survey, use the UI to generate heat maps, export PCAPs for each zone, and compare channel utilization.

flowchart LR
  subgraph Survey[Site Survey Process]
    direction TB
    A[Define Survey Area] --> B[Deploy WiFi Antennas]
    B --> C[Deploy BLEShark Nano Nodes]
    C --> D[Run Kismet (Passive Capture)]
    D --> E[Collect Data for 30‑60 min]
    E --> F[Export PCAP & CSV]
    F --> G[Analyze Heatmaps & Alerts]
    G --> H[Generate Report]
  end
  H --> I[Recommendations for AP Placement]
  I --> J[Validate with Follow‑up Scan]

The diagram illustrates a repeatable methodology that scales from a small office to a multi‑floor campus. Because Kismet stores timestamps for every frame, you can also perform temporal analysis to see how device density changes throughout the day.

Shiver Mesh Integration

The Shiver mesh network, built on ESP‑NOW, can be used as a low‑cost backhaul for Kismet data in environments where WiFi coverage is spotty. Each Shiver node can forward captured frames to a central Kismet server over a custom UDP tunnel, effectively extending the survey radius without adding more WiFi adapters.

Key specifications of Shiver mesh:

• Up to 16 nodes per mesh.
• ESP‑NOW at 250 kbps long‑range mode.
• Typical node‑to‑node range of 20‑50 m, depending on obstacles.

To integrate, configure each node with the BLEShark Nano firmware that forwards BLE advertisements to the mesh. Kismet will see those advertisements as if they originated from a local BLE radio, giving you a unified view of both WiFi and BLE across the entire mesh.

EU Compliance Notes

In the European Union, active deauthentication attacks are prohibited for non‑authorized testing. Kismet therefore disables the deauth module by default when the EU_MODE=1 flag is set in kismet.conf. Handshake capture is limited to passive listening; Kismet will not inject probe requests or association frames. This configuration ensures that your surveys remain legal while still providing the data needed for security assessments.

Conclusion

Kismet offers a depth of visibility that simpler scanners simply cannot match. Its ability to ingest WiFi and BLE sources, present data through an intuitive web UI, and export raw PCAP files makes it the go‑to choice for comprehensive site surveys. When paired with the BLEShark Nano and optionally the Shiver mesh, you get a portable, battery‑powered, and scalable solution that covers both 2.4 GHz WiFi and BLE ecosystems.

Disclaimer: The information provided in this article is for educational purposes only. The use of Kismet or any other wireless network analysis tool should be done in accordance with applicable laws and regulations.

By George Maxutov