Keys and MAC addresses
MAC addresses
The MAC address is a theoretically unique identifier given to a device at manufacture time. For Ethernet and Wi-Fi devices, this is assigned by the IEEE, and must be unique.
Typically a MAC address is 6 bytes. Kismet supports MAC addresses up to 8 bytes, however no PHYs currently use these.
Kismet will attempt to synthesize MAC addresses for PHYs which do not present traditional MAC addresses.
Keys
Kismet uses a unique key for each device. The key is derived from the MAC address, but contains additional information about the PHY type. This allows multiple devices to have the same MAC address under different PHY types without overlap; this can be of particular importance when using non-traditional PHY types which do not use strict device identifiers.
MAC address masking
On queries and filters affecting MAC addresses, Kismet supports complete addresses or partial addresses with masking.
A masked address resembles the syntax typically used for IP network masking: [MAC]/[MASK]
.
For instance, to match only the OUI, a masked MAC of:
"aa:bb:cc:00:00:00/ff:ff:ff:00:00:00"
This would match any MAC address where the OUI, or first three bytes, are “aa:bb:cc”. A similar feature to match on the first four bytes would be:
"aa:bb:cc:dd:00:00/ff:ff:ff:ff:00:00"