Reading Log Files
Kismet can use log files as a data source, including Pcap or PcapNg capture files.
When reprocessing a file,
Kismet attempts to replay through the file as fast as possible.
Kismet has two options to throttle the processing.
If we want to control Kismet’s processing rate,
we can use the pps option
to set a packets-persecond processing rate.
If we want the file processed at the original capture rate,
we can set the realtime flag to true.
This option is useful when we have a large file and limited CPU resources.
The pps and realtime options are mutually exclusive.
Let’s try this out with a sample capture file from the Wireshark website.
We will use -c to specify the downloaded log file as our source
and we will append realtime=true
to have kismet process the file at the original capture rate.
We may need to wait a few moments for the complete results to display.
Even though another tool created the .pcap file,
Kismet identified one access point
and three devices from the file’s content.
While we're not particularly focused on it right now,
Kismet also identified that Management Frame Protection
wasn’t enabled on the network.
This alert is an example of Kismet’s Wireless Intrusion Detection System.