Skip to content
HackIndex.io

Passive Wireless Scanning with Kismet

3 min read Created Mar 17, 2026 Last updated Sep 12, 2026

Kismet is a passive wireless network detector and packet capture tool. Unlike airodump-ng it handles multiple interfaces simultaneously, supports multiple radio types beyond 802.11, logs persistently to a SQLite database, and exposes a web interface for browsing discovered devices. It is particularly useful for long-running passive surveys and environments where you need to capture across both 2.4 GHz and 5 GHz at the same time without channel hopping penalties.

Install Kismet on Kali

Kismet is available in the Kali repositories:

┌──(kali㉿kali)-[~]
└─$ apt update && apt install -y kismet

Add your user to the kismet group so it can access capture interfaces without running the full process as root:

┌──(kali㉿kali)-[~]
└─$ usermod -aG kismet $USER

Log out and back in for the group membership to take effect.

Start Kismet for Wireless Scanning

Start Kismet with a capture interface. The interface does not need to be in monitor mode first: Kismet handles that itself:

┌──(kali㉿kali)-[~]
└─$ kismet -c wlan0

Kismet starts a web server on port 2501. Open a browser and navigate to http://localhost:2501 to access the interface. On first run it prompts you to set a login password.

To run without the terminal UI and purely as a background daemon:

┌──(kali㉿kali)-[~]
└─$ kismet -c wlan0 --no-ncurses

Capture on Multiple Interfaces Simultaneously

To run two adapters at the same time, one on 2.4 GHz and one on 5 GHz, specify both sources:

┌──(kali㉿kali)-[~]
└─$ kismet -c wlan0 -c wlan1

This is one of Kismet's main advantages over airodump-ng for reconnaissance: two adapters covering different bands simultaneously with no hopping gaps.

Lock a Source to a Specific Channel

To fix an interface to a single channel rather than hopping:

┌──(kali㉿kali)-[~]
└─$ kismet -c wlan0:channel=6

Web Interface

The web interface at http://localhost:2501 shows a live device list with signal strength, encryption type, channel, manufacturer, and associated clients per AP. Clicking any device opens a detail panel with all captured metadata.

The Devices view supports filtering by:

  • Type: access point, client, bridged device

  • Encryption: WPA2, WPA3, WEP, open

  • SSID or BSSID: match a specific network name or MAC

  • WPS status: narrow to WPS-enabled APs for targeted attacks

Log Files

Kismet logs to ~/.kismet/ by default. Logs are written in .kismet SQLite format and optionally as .pcapng files:

┌──(kali㉿kali)-[~]
└─$ ls -lh ~/.kismet/ 
Kismet-20240315-14-22-00-1.kismet
Kismet-20240315-14-22-00-1.pcapng

Kismet produces two log types:

  • .kismet: SQLite database containing all device records, signal data, and metadata. Can be queried directly or converted with kismetdb_to_pcap.

  • .pcapng: raw packet capture in pcapng format, ready for Wireshark or tshark.

Export Captures for Wireshark or Aircrack-ng

Convert the Kismet log to a standard pcap file for use with other tools:

┌──(kali㉿kali)-[~]
└─$ kismetdb_to_pcap --in Kismet-20240315-14-22-00-1.kismet --out capture.pcap

The resulting .pcap can be opened in Wireshark or passed to aircrack-ng and hcxtools for handshake extraction and cracking.

Remote Capture

To run a Kismet capture source on a remote sensor and send frames to a central Kismet server, use the remote capture helper on the sensor:

┌──(kali㉿kali)-[~]
└─$ kismet_cap_linux_wifi --connect $SERVER_IP:3501 --source wlan0

The central Kismet server must be started first and listening on port 3501. Remote capture is useful when the sensor is a small device like a Raspberry Pi placed closer to the target.

References