Skip to content
HackIndex logo

HackIndex

Passive Wireless Scanning with Kismet

3 min read Apr 24, 2026

Kismet is a passive wireless network detector and packet capture tool. Unlike airodump-ng it handles multiple interfaces simultaneously, supports multiple radio types beyond 802.11, logs persistently to a SQLite database, and exposes a web interface for browsing discovered devices. It is particularly useful for long-running passive surveys and environments where you need to capture across both 2.4 GHz and 5 GHz at the same time without channel hopping penalties.

Install Kismet on Kali

Kismet is available in the Kali repositories:

┌──(kali㉿kali)-[~]
└─$ apt update && apt install -y kismet

Add your user to the kismet group so it can access capture interfaces without running the full process as root:

┌──(kali㉿kali)-[~]
└─$ usermod -aG kismet $USER

Log out and back in for the group membership to take effect.

Start Kismet

Start Kismet with a capture interface. The interface does not need to be in monitor mode first — Kismet handles that itself:

┌──(kali㉿kali)-[~]
└─$ kismet -c wlan0

Kismet starts a web server on port 2501. Open a browser and navigate to http://localhost:2501 to access the interface. On first run it prompts you to set a login password.

To run without the terminal UI and purely as a background daemon:

┌──(kali㉿kali)-[~]
└─$ kismet -c wlan0 --no-ncurses

Capture on Multiple Interfaces Simultaneously

To run two adapters at the same time, one on 2.4 GHz and one on 5 GHz, specify both sources:

┌──(kali㉿kali)-[~]
└─$ kismet -c wlan0 -c wlan1

This is one of Kismet's main advantages over airodump-ng for reconnaissance — two adapters covering different bands simultaneously with no hopping gaps.

Lock a Source to a Specific Channel

To fix an interface to a single channel rather than hopping:

┌──(kali㉿kali)-[~]
└─$ kismet -c wlan0:channel=6

Web Interface

The web interface at http://localhost:2501 shows a live device list with signal strength, encryption type, channel, manufacturer, and associated clients per AP. Clicking any device opens a detail panel with all captured metadata.

The Devices view can be filtered by type, encryption, SSID, or BSSID. Use the filter bar to narrow to WEP networks, open networks, or WPS-enabled APs for prioritisation.

Log Files

Kismet logs to the current working directory by default. Logs are written in .kismet SQLite format and optionally as .pcapng files:

┌──(kali㉿kali)-[~]
└─$ ls -lh ~/.kismet/ 
Kismet-20240315-14-22-00-1.kismet
Kismet-20240315-14-22-00-1.pcapng

The .kismet file is a SQLite database containing all device records, signal data, and metadata. The .pcapng file contains the raw packet capture.

Export Captures for Wireshark or Aircrack-ng

Convert the Kismet log to a standard pcap file for use with other tools:

┌──(kali㉿kali)-[~]
└─$ kismetdb_to_pcap --in Kismet-20240315-14-22-00-1.kismet --out capture.pcap

The resulting .pcap can be opened in Wireshark or passed to aircrack-ng and hcxtools for handshake extraction and cracking.

Remote Capture

To run a Kismet capture source on a remote sensor and send frames to a central Kismet server, use the remote capture helper on the sensor:

┌──(kali㉿kali)-[~]
└─$ kismet_cap_linux_wifi --connect $SERVER_IP:3501 --source wlan0

The central Kismet server must be started first and listening on port 3501. Remote capture is useful when the sensor is a small device like a Raspberry Pi placed closer to the target.

References