Pcap
Earlier in this module we configured Kismet to output kismet and PcapNg files.
Even if we only have kismet log files, we can use the kismetdb_to_pcap tool
to convert kismet logs to Pcap and PcapNg logs.
The tool is straightforward to use.
However, we must keep in mind that Kismet can capture multiple data types
from multiple data sources.
There are tools that cannot handle different data types within a PcapNg file.
Let’s run kismetdb_to_pcap, specifying our kismet log file with the in flag,
and using the list-datasources flag…
to get a list of data sources in that log file.
We do not need to use the datasource flag since there is only one data source.
We will use kismetdb_to_pcap, setting in to our kismet file
and out to our new PcapNg file.
Now that we have a PcapNg file, we could open it in Wireshark or other tools
for further processing and analysis.