# Passive Wireless Scanning with Kismet

> Discover and fingerprint wireless networks passively using Kismet to capture beacon frames, probe requests, and device metadata without transmitting packets.

- **URL:** https://hackindex.io/platforms/wireless/reconnaissance/passive-scanning-with-kismet
- **Path:** Wireless > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/platforms/wireless/reconnaissance.md)
- **Published:** 2026-03-17
- **Updated:** 2026-09-12

Kismet is a passive wireless network detector and packet capture tool. Unlike airodump-ng it handles multiple interfaces simultaneously, supports multiple radio types beyond 802.11, logs persistently to a SQLite database, and exposes a web interface for browsing discovered devices. It is particularly useful for long-running passive surveys and environments where you need to capture across both 2.4 GHz and 5 GHz at the same time without channel hopping penalties.

## Install Kismet on Kali

Kismet is available in the Kali repositories:

```bash
apt update && apt install -y kismet
```

Add your user to the kismet group so it can access capture interfaces without running the full process as root:

```bash
usermod -aG kismet $USER
```

Log out and back in for the group membership to take effect.

## Start Kismet for Wireless Scanning

Start Kismet with a capture interface. The interface does not need to be in monitor mode first: Kismet handles that itself:

```bash
kismet -c wlan0
```

Kismet starts a web server on port 2501. Open a browser and navigate to `http://localhost:2501` to access the interface. On first run it prompts you to set a login password.

To run without the terminal UI and purely as a background daemon:

```bash
kismet -c wlan0 --no-ncurses
```

## Capture on Multiple Interfaces Simultaneously

To run two adapters at the same time, one on 2.4 GHz and one on 5 GHz, specify both sources:

```bash
kismet -c wlan0 -c wlan1
```

This is one of Kismet's main advantages over airodump-ng for reconnaissance: two adapters covering different bands simultaneously with no hopping gaps.

## Lock a Source to a Specific Channel

To fix an interface to a single channel rather than hopping:

```bash
kismet -c wlan0:channel=6
```

## Web Interface

The web interface at `http://localhost:2501` shows a live device list with signal strength, encryption type, channel, manufacturer, and associated clients per AP. Clicking any device opens a detail panel with all captured metadata.

The Devices view supports filtering by:

- **Type**: access point, client, bridged device
- **Encryption**: WPA2, WPA3, WEP, open
- **SSID or BSSID**: match a specific network name or MAC
- **WPS status**: narrow to WPS-enabled APs for targeted attacks

## Log Files

Kismet logs to `~/.kismet/` by default. Logs are written in `.kismet` SQLite format and optionally as `.pcapng` files:

```bash
ls -lh ~/.kismet/
# Kismet-20240315-14-22-00-1.kismet
# Kismet-20240315-14-22-00-1.pcapng
```

Kismet produces two log types:

- **`.kismet`**: SQLite database containing all device records, signal data, and metadata. Can be queried directly or converted with `kismetdb_to_pcap`.
- **`.pcapng`**: raw packet capture in pcapng format, ready for Wireshark or tshark.

## Export Captures for Wireshark or Aircrack-ng

Convert the Kismet log to a standard pcap file for use with other tools:

```bash
kismetdb_to_pcap --in Kismet-20240315-14-22-00-1.kismet --out capture.pcap
```

The resulting `.pcap` can be opened in Wireshark or passed to aircrack-ng and hcxtools for handshake extraction and cracking.

## Remote Capture

To run a Kismet capture source on a remote sensor and send frames to a central Kismet server, use the remote capture helper on the sensor:

```bash
kismet_cap_linux_wifi --connect $SERVER_IP:3501 --source wlan0
```

The central Kismet server must be started first and listening on port 3501. Remote capture is useful when the sensor is a small device like a Raspberry Pi placed closer to the target.

## References

- [Kismet: Official Documentation](https://www.kismetwireless.net/docs/readme/) - Full reference for configuration, data sources, and log formats
- [Kismet: Datasources](https://www.kismetwireless.net/docs/readme/datasources/) - Multi-interface and remote capture source configuration