12. Capture Sources
A capture source in Kismet is anything which provides packets to the Kismet
engine. Capture sources define the underlying engine needed to capture
data from the interface, how to change channel, and how to enter rfmon
mode. It is necessary to tell Kismet what specific type of card you use
because different drivers often use different methods to report information
and enter monitor mode.
Source type Cards OS Driver
--------------- ------------------- ----------- -------------------------
acx100 TI ACX100 Linux ACX100
http://acx100.sourceforge.net/
Capture interface: 'ethX'
ACX100 drivers handle the 22mbit cards branded by D-Link
and others.
admtek ADMTek Linux ADMTek
http://www.latinsud.com/adm8211/ (Patches)
http://aluminum.sourmilk.net/adm8211/ (GPL driver)
ADMTek drivers used in many consumer 802.11b cards. With
the patches above, quasi-rfmon is possible - these cards
appear to be almost entirely software controlled and
always in a rfmon-like state. This card WILL BROADCAST
while in rfmon, rendering the sniffer visible.
The fully GPL drivers are supported, in addition to the
hacks to the non-free drivers.
atmel_usb Atmel-USB Linux Berlios-Atmel
http://at76c503a.berlios.de/
Capture interface: 'wlanX'
These drivers work ONLY on USB cards (Sorry, no PCMCIA
support). Monitor mode support is limited and "faked"
by bypassing part of the firmware and parsing packets
directly, and is likely to not report all of the
frames.
This card MAY BROADCAST while in rfmon, rendering the
sniffer visible.
It appears that this card may be only formatting the
beacons as an 802.11 stream, which means you likely
will not see data frames, rendering most IDS functions,
IP discovery, and data logging unavailable.
cisco Aironet 340,350 Linux Kernel 2.4.10 - 2.4.19
Capture interface: 'ethX'
Standard Cisco cards in Linux. Works only with
the Linux kernel drivers, not the drivers found in
pcmcia-cs.
The drivers found on the cisco.com site can be patched
with the files from the Kismet download site to add
monitor mode with channel control, HOWEVER these drivers
are extremely buggy for normal use and work only with
the 2.4 kernel tree.
The cisco drivers currently do not enter rfmon mode
correctly, so channel control is not available. The
firmware will hop to whatever channel it feels like
hopping to, when it feels like hopping.
cisco_wifix Aironet 340,350 Linux Kernel 2.4.20+, CVS
http://sourceforge.net/projects/airo-linux/
Capture interface: 'ethX:wifiX'
Kernel 2.4.20+ and CVS drivers use ethX for normal mode
and wifiX for monitor mode. Kismet needs to know both
devices, which may not necessarily be the same number,
for example 'eth1:wifi0'.
Linux kernel 2.4.20 and 2.4.21 have highly unstable cisco
drivers and should be avoided.
The cisco drivers currently do not enter rfmon mode
correctly, so channel control is not available. The
firmware will hop to whatever channel it feels like
hopping to, when it feels like hopping.
cisco_openbsd Aironet 340,350 OpenBSD Kernel
Capture interface: 'anX'
OpenBSD cisco drivers are not fully supported currently,
but may become so. Packet capture probably will not
work correctly.
For current OpenBSD releases you should try the
radiotap_bsd_b capture source, NOT this one.
hostap Prism/2 Linux HostAP 0.4
http://hostap.epitest.fi/
Capture interface: 'wlanX'
HostAP drivers drive the Prism/2 chipset in access point
mode, but also can drive the cards in client and monitor
modes. The HostAP drivers seem to change how they go
into monitor mode fairly often, but this source should
manage to get them going.
ipw2100 Intel/Centrino Linux ipw2100-0.44+
http://ipw2100.sourceforge.net/
Capture interface: 'ethX'
The Linux IPW2100/Centrino drivers for 802.11b cards
now support rfmon, so here's support for them. They act
more or less like any other wireless interface would.
THIS IS NOT FOR WINDOWS OR FOR LINUX SYSTEMS USING
NDISWRAPPER OR LINUXANT.
ipw2200 Intel/Centrino Linux ipw2200-1.0.4+
http://ipw2200.sourceforge.net/
Capture interface: 'ethX'
The Linux IPW2200/Centrino drivers for 802.11bg cards
support rfmon as of 1.0.4 and firmware 2.3.
THIS IS NOT FOR WINDOWS OR FOR LINUX SYSTEMS USING
NDISWRAPPER OR LINUXANT.
ipw2915 Intel/Centrino Linux ipw2200-1.0.4+
http://ipw2200.sourceforge.net/
Capture interface: 'ethX'
The Linux IPW2200/Centrino drivers for 802.11bg cards
support rfmon as of 1.0.4 and firmware 2.3.
This is the same as ipw2200 but defaults to scanning the
802.11a channel range in addition to 802.11b/g.
kismet_drone n/a Any n/a
Capture interface: 'dronehost:port'
The remote drone capture source connects to a Kismet
drone and proceses the packets. Refer to the Remote
Drone section of the README for more details about how
to set up a drone.
madwifi_a Atheros Linux madwifi-cvs
http://sourceforge.net/projects/madwifi/
Capture interface: 'athX'
Madwifi drivers in 802.11a-only mode.
madwifi_b Atheros Linux madwifi-cvs
http://sourceforge.net/projects/madwifi/
Capture interface: 'athX'
Madwifi drivers in 802.11b-only mode.
madwifi_g Atheros Linux madwifi-cvs
http://sourceforge.net/projects/madwifi/
Capture interface: 'athX'
Madwifi drivers in 802.11g-only mode. This will,
obviously, also see 11b networks.
madwifi_ab Atheros Linux madwifi-cvs
http://sourceforge.net/projects/madwifi/
Capture interface: 'athX'
Madwifi drivers in 802.11a and 802.11b combo mode. This
will seamlessly switch between bands during channel
hopping.
madwifi_ag Atheros Linux madwifi-cvs
http://sourceforge.net/projects/madwifi/
Capture interface: 'athX'
Madwifi drivers in 802.11a and 802.11g combo mode. This
will seamlessly switch between bands during channel
hopping.
orinoco Lucent, Orinoco Linux Patched orinoco_cs
http://airsnort.shmoo.com/orinocoinfo.html
Capture interface: 'ethX'
The orinoco-cs drivers do not support monitor mode as-is,
but patches are on the Kismet download site for
standalone drivers, Linux 2.6 kernel drivers, and
Linux 2.6.9+ kernel drivers. These expanded patches fix
several performance issues with previous monitor mode
patches.
orinoco_14 Lucent, Orinoco Linux Orinoco 0.14+
https://savannah.nongnu.org/projects/orinoco/
Capture interface: 'ethX'
The new orinoco_cs drivers changed things subtly, but
at least they include rfmon without patching.
Patches to enable signal level reporting are available on
the kismet download site.
These drivers are NOT CURRENTLY RECCOMENDED. Once the new
Orinoco drivers have solidified, final patches for
per-packet stats will be made and this source changed.
pcapfile n/a Any n/a
Capture interface: '/path/to/file'
The pcapfile capture source feeds a stored 802.11-encap
dump file through the Kismet engine again. This can be
useful for debugging or rescanning old logs for
alert conditions. Pcapfile sources are only available
if Kismet was compiled with libpcap support.
prism2_openbsd Prism/2 OpenBSD Kernel
Capture interface: 'wiX'
Full support for Prism2 under older OpenBSD releases.
This should soon be deprecated, if possible use the
radiotap_bsd_b capture type.
prism54g PrismGT Linux prism54
http://www.prism54.org
Capture interface: 'ethX'
PrismGT 802.11g drivers supporting monitor mode.
radiotap_bsd_ab Radiotap BSD Kernel
Capture interface: various
Dual-band cards with radiotap headers.
radiotap_bsd_a Radiotap BSD Kernel
Capture interface: various
802.11a cards (or dual-band on 11a channels only) with
radiotap headers.
radiotap_bsd_b Radiotap BSD Kernel
Capture interface: various
802.11b/g cards (or dual-band on 11b channels only) with
radiotap headers.
rt2400 Ralink 2400 11b Linux rt2400-gpl
Capture interface: 'ethX'
http://rt2x00.serialmonkey.com/
Ralink 2400 802.11b cards using the serialmonkey GPL'd
rt2x00 drivers. Must use 1.2.2 beta 2 or newer drivers.
rt2500 Ralink 2500 11g Linux rt2500-gpl
Capture interface: 'ethX'
http://rt2x00.serialmonkey.com/
Ralink 2500 802.11g cards using the serialmonkey GPL'd
rt2x00 drivers. Must use 1.1.0 beta 2 or newer drivers.
rt8180 Realtek 8180 11b Linux rtl8180-sa2400
Capture interface: 'ethX'
http://rtl8180-sa2400.sourceforge.net/
Realtek 8180 based cards (there seem to be an awful lot of
them) using the GPL drivers.
viha Airport OSX viha
http://www.dopesquad.net/security/
Capture interface: 'enX'
Monitor mode support for Airport under OSX. Does not
support Airport Extreme.
vtar5k Atheros 802.11a Linux vtar5k
http://team.vantronix.net/ar5k/
vtar5k drivers handle some Atheros 802.11a cards. Chances
are you'll have better luck with madwifi drivers.
wlanng_legacy Prism/2 Linux wlan-ng 0.1.3 and earlier
http://www.linux-wlan.com/
Capture interface: 'wlanX'
Old wlan-ng drivers didn't support pcap capturing and
use a netlink socket to the kernel. These are still in
use on some embedded systems (like the Zaurus).
wlanng Prism/2 Linux wlan-ng 0.1.4 - 0.1.9
http://www.linux-wlan.com/
Capture interface: 'wlanX'
Wlan-ng prism2 drivers prior to the AVS headers.
wlanng_avs Prism/2 Linux wlan-ng 0.2.0+
http://www.linux-wlan.com/
Capture interface: 'wlanX'
Newer wlan-ng drivers support a new header type and
slightly different monitor commands to report wepped
packets.
wrt54g Linksys WRT54G Linux linksys
http://seattlewireless.net/index.cgi/LinksysWrt54g
Capture interface: 'ethX'
Capture interface: 'ethX:prismX'
Support for the drivers found in the embedded Linux
inside the Linksys WRT54G (and probably other APs using
the same firmware).
Newer firmwares (such as OpenWRT) use the prism0 device
for monitor mode data. On these firmwares, specify both
interfaces (wrt54g,eth1:prism0,foo)
wsp100 NetChem WSP100 Any n/a
http://networkchemistry.com/
Capture interface: 'host:port'
The WSP100 is an embedded device which reports 802.11
packets over UDP. The wsp100 capture source is
(generally) system agnostic, however over time it has
been less maintained than others. If you'd like to
send me patches for this, please let me know.
wtapfile n/a Any n/a
Capture interface: '/path/to/file'
Wtapfile sources are the same as pcapfile sources but
they use the Ethereal libwiretap loader. libwiretap can
automatically decompress gzipped files, etc. Wtapfile
sources are only available if Kismet was compiled with
libwiretap support.
Chipsets known to NOT WORK:
Broadcom - No linux drivers, only useable with ndiswrapper or
linuxant wrappers around windows drivers.
Airport Extreme - Really a Broadcom, with no rfmon in the OSX drivers.
Atmel - There is a hack for pseudo-monitor in USB. There is
currently no equivalent hack for PCMCIA.
HermesII - Proxim successor to the Orinoco/HermesI. No support
yet in the drivers, may be available in the future.
ndiswrapper - Anything using ndiswrapper is using WINDOWS drivers
AND CAN NOT BE USED WITH KISMET.