12. Capture Sources A capture source in Kismet is anything which provides packets to the Kismet engine. Capture sources define the underlying engine needed to capture data from the interface, how to change channel, and how to enter rfmon mode. It is necessary to tell Kismet what specific type of card you use because different drivers often use different methods to report information and enter monitor mode. Source type Cards OS Driver --------------- ------------------- ----------- ------------------------- acx100 TI ACX100 Linux ACX100 http://acx100.sourceforge.net/ Capture interface: 'ethX' ACX100 drivers handle the 22mbit cards branded by D-Link and others. admtek ADMTek Linux ADMTek http://www.latinsud.com/adm8211/ (Patches) http://aluminum.sourmilk.net/adm8211/ (GPL driver) ADMTek drivers used in many consumer 802.11b cards. With the patches above, quasi-rfmon is possible - these cards appear to be almost entirely software controlled and always in a rfmon-like state. This card WILL BROADCAST while in rfmon, rendering the sniffer visible. The fully GPL drivers are supported, in addition to the hacks to the non-free drivers. atmel_usb Atmel-USB Linux Berlios-Atmel http://at76c503a.berlios.de/ Capture interface: 'wlanX' These drivers work ONLY on USB cards (Sorry, no PCMCIA support). Monitor mode support is limited and "faked" by bypassing part of the firmware and parsing packets directly, and is likely to not report all of the frames. This card MAY BROADCAST while in rfmon, rendering the sniffer visible. It appears that this card may be only formatting the beacons as an 802.11 stream, which means you likely will not see data frames, rendering most IDS functions, IP discovery, and data logging unavailable. cisco Aironet 340,350 Linux Kernel 2.4.10 - 2.4.19 Capture interface: 'ethX' Standard Cisco cards in Linux. Works only with the Linux kernel drivers, not the drivers found in pcmcia-cs. The drivers found on the cisco.com site can be patched with the files from the Kismet download site to add monitor mode with channel control, HOWEVER these drivers are extremely buggy for normal use and work only with the 2.4 kernel tree. The cisco drivers currently do not enter rfmon mode correctly, so channel control is not available. The firmware will hop to whatever channel it feels like hopping to, when it feels like hopping. cisco_wifix Aironet 340,350 Linux Kernel 2.4.20+, CVS http://sourceforge.net/projects/airo-linux/ Capture interface: 'ethX:wifiX' Kernel 2.4.20+ and CVS drivers use ethX for normal mode and wifiX for monitor mode. Kismet needs to know both devices, which may not necessarily be the same number, for example 'eth1:wifi0'. Linux kernel 2.4.20 and 2.4.21 have highly unstable cisco drivers and should be avoided. The cisco drivers currently do not enter rfmon mode correctly, so channel control is not available. The firmware will hop to whatever channel it feels like hopping to, when it feels like hopping. cisco_openbsd Aironet 340,350 OpenBSD Kernel Capture interface: 'anX' OpenBSD cisco drivers are not fully supported currently, but may become so. Packet capture probably will not work correctly. For current OpenBSD releases you should try the radiotap_bsd_b capture source, NOT this one. hostap Prism/2 Linux HostAP 0.4 http://hostap.epitest.fi/ Capture interface: 'wlanX' HostAP drivers drive the Prism/2 chipset in access point mode, but also can drive the cards in client and monitor modes. The HostAP drivers seem to change how they go into monitor mode fairly often, but this source should manage to get them going. ipw2100 Intel/Centrino Linux ipw2100-0.44+ http://ipw2100.sourceforge.net/ Capture interface: 'ethX' The Linux IPW2100/Centrino drivers for 802.11b cards now support rfmon, so here's support for them. They act more or less like any other wireless interface would. THIS IS NOT FOR WINDOWS OR FOR LINUX SYSTEMS USING NDISWRAPPER OR LINUXANT. ipw2200 Intel/Centrino Linux ipw2200-1.0.4+ http://ipw2200.sourceforge.net/ Capture interface: 'ethX' The Linux IPW2200/Centrino drivers for 802.11bg cards support rfmon as of 1.0.4 and firmware 2.3. THIS IS NOT FOR WINDOWS OR FOR LINUX SYSTEMS USING NDISWRAPPER OR LINUXANT. ipw2915 Intel/Centrino Linux ipw2200-1.0.4+ http://ipw2200.sourceforge.net/ Capture interface: 'ethX' The Linux IPW2200/Centrino drivers for 802.11bg cards support rfmon as of 1.0.4 and firmware 2.3. This is the same as ipw2200 but defaults to scanning the 802.11a channel range in addition to 802.11b/g. kismet_drone n/a Any n/a Capture interface: 'dronehost:port' The remote drone capture source connects to a Kismet drone and proceses the packets. Refer to the Remote Drone section of the README for more details about how to set up a drone. madwifi_a Atheros Linux madwifi-cvs http://sourceforge.net/projects/madwifi/ Capture interface: 'athX' Madwifi drivers in 802.11a-only mode. madwifi_b Atheros Linux madwifi-cvs http://sourceforge.net/projects/madwifi/ Capture interface: 'athX' Madwifi drivers in 802.11b-only mode. madwifi_g Atheros Linux madwifi-cvs http://sourceforge.net/projects/madwifi/ Capture interface: 'athX' Madwifi drivers in 802.11g-only mode. This will, obviously, also see 11b networks. madwifi_ab Atheros Linux madwifi-cvs http://sourceforge.net/projects/madwifi/ Capture interface: 'athX' Madwifi drivers in 802.11a and 802.11b combo mode. This will seamlessly switch between bands during channel hopping. madwifi_ag Atheros Linux madwifi-cvs http://sourceforge.net/projects/madwifi/ Capture interface: 'athX' Madwifi drivers in 802.11a and 802.11g combo mode. This will seamlessly switch between bands during channel hopping. orinoco Lucent, Orinoco Linux Patched orinoco_cs http://airsnort.shmoo.com/orinocoinfo.html Capture interface: 'ethX' The orinoco-cs drivers do not support monitor mode as-is, but patches are on the Kismet download site for standalone drivers, Linux 2.6 kernel drivers, and Linux 2.6.9+ kernel drivers. These expanded patches fix several performance issues with previous monitor mode patches. orinoco_14 Lucent, Orinoco Linux Orinoco 0.14+ https://savannah.nongnu.org/projects/orinoco/ Capture interface: 'ethX' The new orinoco_cs drivers changed things subtly, but at least they include rfmon without patching. Patches to enable signal level reporting are available on the kismet download site. These drivers are NOT CURRENTLY RECCOMENDED. Once the new Orinoco drivers have solidified, final patches for per-packet stats will be made and this source changed. pcapfile n/a Any n/a Capture interface: '/path/to/file' The pcapfile capture source feeds a stored 802.11-encap dump file through the Kismet engine again. This can be useful for debugging or rescanning old logs for alert conditions. Pcapfile sources are only available if Kismet was compiled with libpcap support. prism2_openbsd Prism/2 OpenBSD Kernel Capture interface: 'wiX' Full support for Prism2 under older OpenBSD releases. This should soon be deprecated, if possible use the radiotap_bsd_b capture type. prism54g PrismGT Linux prism54 http://www.prism54.org Capture interface: 'ethX' PrismGT 802.11g drivers supporting monitor mode. radiotap_bsd_ab Radiotap BSD Kernel Capture interface: various Dual-band cards with radiotap headers. radiotap_bsd_a Radiotap BSD Kernel Capture interface: various 802.11a cards (or dual-band on 11a channels only) with radiotap headers. radiotap_bsd_b Radiotap BSD Kernel Capture interface: various 802.11b/g cards (or dual-band on 11b channels only) with radiotap headers. rt2400 Ralink 2400 11b Linux rt2400-gpl Capture interface: 'ethX' http://rt2x00.serialmonkey.com/ Ralink 2400 802.11b cards using the serialmonkey GPL'd rt2x00 drivers. Must use 1.2.2 beta 2 or newer drivers. rt2500 Ralink 2500 11g Linux rt2500-gpl Capture interface: 'ethX' http://rt2x00.serialmonkey.com/ Ralink 2500 802.11g cards using the serialmonkey GPL'd rt2x00 drivers. Must use 1.1.0 beta 2 or newer drivers. rt8180 Realtek 8180 11b Linux rtl8180-sa2400 Capture interface: 'ethX' http://rtl8180-sa2400.sourceforge.net/ Realtek 8180 based cards (there seem to be an awful lot of them) using the GPL drivers. viha Airport OSX viha http://www.dopesquad.net/security/ Capture interface: 'enX' Monitor mode support for Airport under OSX. Does not support Airport Extreme. vtar5k Atheros 802.11a Linux vtar5k http://team.vantronix.net/ar5k/ vtar5k drivers handle some Atheros 802.11a cards. Chances are you'll have better luck with madwifi drivers. wlanng_legacy Prism/2 Linux wlan-ng 0.1.3 and earlier http://www.linux-wlan.com/ Capture interface: 'wlanX' Old wlan-ng drivers didn't support pcap capturing and use a netlink socket to the kernel. These are still in use on some embedded systems (like the Zaurus). wlanng Prism/2 Linux wlan-ng 0.1.4 - 0.1.9 http://www.linux-wlan.com/ Capture interface: 'wlanX' Wlan-ng prism2 drivers prior to the AVS headers. wlanng_avs Prism/2 Linux wlan-ng 0.2.0+ http://www.linux-wlan.com/ Capture interface: 'wlanX' Newer wlan-ng drivers support a new header type and slightly different monitor commands to report wepped packets. wrt54g Linksys WRT54G Linux linksys http://seattlewireless.net/index.cgi/LinksysWrt54g Capture interface: 'ethX' Capture interface: 'ethX:prismX' Support for the drivers found in the embedded Linux inside the Linksys WRT54G (and probably other APs using the same firmware). Newer firmwares (such as OpenWRT) use the prism0 device for monitor mode data. On these firmwares, specify both interfaces (wrt54g,eth1:prism0,foo) wsp100 NetChem WSP100 Any n/a http://networkchemistry.com/ Capture interface: 'host:port' The WSP100 is an embedded device which reports 802.11 packets over UDP. The wsp100 capture source is (generally) system agnostic, however over time it has been less maintained than others. If you'd like to send me patches for this, please let me know. wtapfile n/a Any n/a Capture interface: '/path/to/file' Wtapfile sources are the same as pcapfile sources but they use the Ethereal libwiretap loader. libwiretap can automatically decompress gzipped files, etc. Wtapfile sources are only available if Kismet was compiled with libwiretap support. Chipsets known to NOT WORK: Broadcom - No linux drivers, only useable with ndiswrapper or linuxant wrappers around windows drivers. Airport Extreme - Really a Broadcom, with no rfmon in the OSX drivers. Atmel - There is a hack for pseudo-monitor in USB. There is currently no equivalent hack for PCMCIA. HermesII - Proxim successor to the Orinoco/HermesI. No support yet in the drivers, may be available in the future. ndiswrapper - Anything using ndiswrapper is using WINDOWS drivers AND CAN NOT BE USED WITH KISMET.