Kismet Frequently Asked Questions

Q: Kismet compiles but fails during link with: "undefined 
reference to `pcap_setnonblock'"
A: You have an old version of libpcap.a somewhere in your link path 
(probably in /usr/lib).  Remove the old version and compile again.
(Resolved in current versions of Kismet)


Q: Is card <x> supported by Kismet?
A: Definitely maybe.  

If it's a prism/2 chipset (supported by wlan-ng) then 
almost definitely yes.  There are new Prism/2 licensees coming out all 
the time.  So long as the wlan-ng drivers can handle the card correctly, 
Kismet can handle the packet sniffs.

If it's a linux-wireless, it should work with pcap capturing already.  
As long as it also has RF Monitor ability, it is supported.


Q: My card can do RF monitoring but doesn't work in Kismet, will you support
it?
A: Yes, I'll certianly try, if you:

a: Give me one for development.

b: Loan me one for however long it takes to write the code.

c: Give me an account on a system with that card installed that I can do 
development on. (and with enough access rights to throw the card into 
promisc mode)


Q: What about Orinoco WaveLAN cards?
A: By all reports the Orinoco WaveLAN card drivers do not support RF Monitor
mode.  This makes it impossible to do "true" sniffing, however the "generic"
packet engine will at least allow you to snoop for SSID's using the SSID 
autodetect features found in most cards.  The generic packet source is 
QUITE limited, but sufficient.

Update: http://airsnort.shmoo.com is a patch by Snax which enables prism/2 style 
raw monitoring mode on Orinoco cards.  This should use the prism2 packetsource.


Q: What GPS receivers are supported?
A: Kismet supports all NMEA-based GPS recievers via the "gpsd" generic GPS 
daemon, as well as some proprietary recievers which gpsd understands.


Q: BSD?
A: As of 03-24-02, OpenBSD is supported and has been tested with Cisco cards.

Kismet can also be compiled on Mac OSX-flavored BSD, however as yet there is no
way to place these cards in RFMon mode (that I know of).


Q: When is local dump used and when is wiretap dump used?
A: Local dump is used if the wiretap library cannot be found, or if the 
--enable-local-dump is specified in the config.  Local dump writes pcap/ethereal
compatable logs.     


Q: configure can't find pcap.h, but I know it's installed.
A: Sometimes pcap is installed in a nonstandard location.  This can be set with 
the CPPFLAGS environment variable, for example, on RH 7.1/7.2, 
CPPFLAGS=-I/usr/include/pcap ./configure.

Q: I'm sure there are encrypted data packets in this network, but they show up
as normal data packets.
A: Kismet uses the 802.11 headers to determine if a packet is encrypted, 
however, sometimes these aren't set correctly.  The prism2 source in particular 
seems to incorrectly set these headers (or, more to the point, doesn't set these
headers.)


Q: Fuzzy encryption detection uses the first fields of data to guess if a 
packet is detected.  This is not foolproof, and may lead to false positives.
Enable fuzzyencryption for your packetsource in the kismet.conf file.  
(introduced in Kismet 1.5 devel)


Q: I get errors that it can't find "glib-config" or "Magick-config" during the
configure process, but I know I have them!
A: You're probably configuring or compiling as root - this is generally a bad
idea both because gcc is a complex program and shouldn't be trusted with root 
and user input, and because root has a stripped-down PATH environment.  You 
should probably configure and compile as a normal user and use root just to 
do the install.


Q: I get warnings that header files have no newline at the end
A: This has been fixed in the 1.5 -devel tree.


Q: The compile fails with an undefined function like "snprintf", "fprintf", etc
A: You probably have a weird (ie, not the same as mine :P ) configuration, which
ultimately means I missed a #include somewhere.  Stick a ``#include <stdio.h>''
at the top of the file with the error, and email me so I can fix it in the 
distribution.


Q: Is there a mailing list?
A: Yes - subscribe at wireless-subscribe@kismetwireless.net.


Q: Why doesn't Kismet enable RF monitoring automatically?
A: In two words, compatability and security.

Kismet is designed to work with as many cards as possible, and to do as little 
to your system as possible.  Putting a card in RF monitoring mode requires root 
access, but it also varies from card to card.  Executing external programs 
automatically as root is a very bad idea.

Additionally, RF monitoring mode disables the ability to send data.  While I 
expect Kismet is primarily used on single-user laptop or portable systems, I 
am still reluctant to place the ability to knock a systems connection out in 
the hands of unprivileged users.


Q: My Cisco doesn't seem to be capturing packets correctly or entering RF 
monitor mode
A: You probably have an old kernel version.  2.4.16 or higher is strongly 
reccomended due to a high number of changes in the cisco driver and the kernel 
wireless extentions in recent kernel versions. 


Q: I'm using the CVS Cisco drivers and can't see any packets
A: You need to capture on the interface 'wifi0' (or 'wifi1', and so on).

Q: Cisco beacons while in RF Monitor mode anyhow!
A: Apparently some do.  I haven't got a good way to turn this off, but the 
cisco_monitor script DOES set the tx power to 1mW, which should be enough to
curtail the problem.

Q: GPSMap segfaults, what gives?
A: Make sure you have the most recent version of ImageMagick (5.4.4-4 as of the
time of this writing).  It fixes many problems with the Imagemagick rendering
code.

