Tuesday, July 1, 2008

Installing/Configuring kismet on Ubuntu

Been experimenting with kismet over the weekend and was finally well enough to configure it after some quick digging.

Installation
Do a simple apt-get to install kismet:
apt-get install kismet
That's all there to it. Please note that the version in Ubuntu's repo is 2007-10-R1-2build1. It's a lot older than the one currenly available for download i.e. Kismet-2008-05-R1.

Configuration
If you run kismet right after installation, you'll get the following error:
Launching kismet_server: //usr/bin/kismet_server
Suid priv-dropping disabled. This may not be secure.
No specific sources given to be enabled, all will be enabled.
Non-RFMon VAPs will be destroyed on multi-vap interfaces (ie, madwifi-ng)
Enabling channel hopping.
Enabling channel splitting.
NOTICE: Disabling channel hopping, no enabled sources are able to change channel.
Source 0 (changeme): Opening none source interface none...
FATAL: Please configure at least one packet source. Kismet will not function if no packet sources are defined in kismet.conf or on the command line. Please read the README for more information about configuring Kismet.
Kismet exiting.
Done.
You'll need to configure kismet and attach it to a wifi device. To do this, open up /etc/kismet/kismet.conf and look for the following line:
source=none,none,changeme
I'm using iwl3945 on eth1 on my machine. So here's my config:
source=iwl3945,eth1,eth1
You can look at the list of supported device in kismet's README file here:
/usr/share/doc/kismet/README
It's gzipped, by default (README.gz). So do a quick gunzip before reading. Look for the list under the section named "Capture Sources".

Running It
Now run kismet again and you'll get a nice screen like below:


Unfortunately, after exiting kismet, I was greeted with a segmentation fault error and my eth1 link unusable (note the UNSPEC word):
eth1 Link encap:UNSPEC HWaddr 00-1C-BF-A8-F9-C2-00-00-00-00-00-00-00-00-00-00
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:458437 errors:0 dropped:0 overruns:0 frame:0
TX packets:499893 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:215177287 (205.2 MB) TX bytes:95043280 (90.6 MB)
This is the main show stopper. Time to whip up Google search and the forums :D

No comments: