Output Files
Kismet creates log files in three different formats:
kismet, PcapPpi, and PcapNg.
The kismet format is the default setting
and includes all the gathered data in a SQLite database.
The PcapPpi format is a legacy Pcap format
while the PcapNg format is the modern Pcap format.
The kismet and PcapNg formats allow for packets from multiple Data Link Types.
In other words, they can contain a mix of Wi-Fi, Bluetooth, etc.
On the other hand Legacy Pcap files can only contain one DLT.
Of these two, the PcapNg format is generally preferred because it allows us
to use the results in other tools, such as Wireshark.
Even though PcapNg supports multiple DLTs, if we enable multiple sensor types during
a capture, for example, both Wi-Fi and Bluetooth,
Kismet will consolidate all the different frame types in the log file.
Other tools may have issues parsing Pcap files with more than one data source.
Let’s change how Kismet logs data by creating an override configuration file.
First, we will review the settings in the kismet logging configuration file.
By default, Kismet creates log files in the current working directory.
Let’s change this to a centralized location in our override file.
We will also change the log types to include PcapNg logs.
The kismet log is useful, but as we mentioned previously, if we want to use
the data from Kismet in other tools,
we will want to log in the PcapNg format as well.
First, let’s create a new directory in /var/log to hold our log files.
Next, we will create the kismet site configuration file,
with our override settings for log prefix to store data in the new directory
and log types to create log files in kismet and PcapNg formats
Now that we have logging configured, let’s move on to data sources.