Remote Capture
Kismet includes separate tools to capture data.
When we run Kismet and specify a source,
it will automatically use the appropriate tool.
For example, when we run a capture on our wireless interface on Kali,
Kismet calls the kismet_cap_linux_wifi tool to handle the capture.
We can also call these tools directly to capture traffic locally
and send the data to a Kismet server running on a remote host.
The server does not initiate the capture,
but it listens for connections and processes the data.
Kismet only allows connections from localhost by default.
We can use this functionality to configure Wi-Fi data
on several smaller, cheaper devices
and send the data to one centralized server for processing and retention.
To enable remote capture,
we need to setup an SSH tunnel to the server
or configure the remote instance of Kismet to listen on a specific network interface.
We can do the latter by changing the remote_capture_listen value
to a specific interface in our override file.
We have two Kali instances with Kimset installed for the following example,
kali and kaliremote.
We will use kali as our server instance
and kaliremote as our capture device since it has a Wi-Fi adapter.
We will restart Kismet on kali without supplying a source parameter.
Since Kismet listens on localhost port 3501,
we need to establish an SSH tunnel from kaliremote,
our capturing instance, to the kali host.
We'll use ssh with the -L flag
to enable port forwarding so that port 8000 on kaliremote
forwards to port 3501 on our kali host.
After establishing an SSH tunnel,
we will open a new terminal on kaliremote and start a data capture.
Let’s use kismet_cap_linux_wifi
with the --connect flag set to localhost on port 8000
and set --source to our wireless interface
to use the local wireless network.
Since we have forwarded port 8000 through our SSH tunnel to port 3501,
kismet_cap_linux_wifi should send the data to our kali host.
At this point, the Kismet instance on kaliremote
captures Wi-Fi data
and sends it through the SSH tunnel to the Kismet server on our kali host.
Our kali host’s kismet application captures data sent from kaliremote.
We will let this run for a little bit, then disconnect our remote connection
by pressing Control C on kali remote.
The Kismet server will continue to run and wait for connections on the kali host.
Even though the Kismet instance on kaliremote handled the capture,
kali host instance handles data processing and logging.
We can now close our SSH tunnel.
This example just scratched the surface of what is possible
with Kismet’s remote capture functionality.
We can use remote capture with multiple devices
to expand our Wi-Fi capturing capabilities.