Kismet Wireless

Kismet Forums


Posted by:dragorn
Subject:Control frames over tun/tap?
Date:17:41:39 06/04/2011

> Let me clarify. I see some CF frames from surrounding APs:
> But I don't see CTS, RST, or ACKs for the ad-hoc network I'm monitoring (PPI headers are also not visible) when connecting to kistap0. These ad-hoc CF frames and the PPI headers are visible if I open the Kismet pcap dump file with Wireshark.

PPI headers are not (currently) on the tuntap. This may change in the future to handle muxing multiphy live export as well.

In general, that's weird. There isn't any filter on the tuntap export that would be cutting them out.

> I'm not sure how to post a snippet since its a binary file. I need to narrow it down to only the relevant packets (most of the packets are background chatter that just clutter up the files).

You can select packets in wireshark, mark them, and export only those packets to a new pcap file.

> > Does replaying the pcap through kismet still not show them?
> How do I do this replay. Use `sudo kismet_server -M <SOMELARGENUMBER> -n -c Kismet_date_time_.pcap` spits out the following error:

You can feed it a new capfile run-time via the ruby clients or the 'add a source' option in kismet_client; start kismet, connect your monitor to tuntap, add a pcapfile source.

Reply to this message