Pcap (and pcapng) are standard formats for logging packets, which most tools which manipulate packets accept, including Tcpdump and Wireshark. A kismetdb log can be converted to pcapng, or Kismet can write pcap logs directly.
There are two main flavors of pcap supported by Kismet:
pcapppiis the legacy pcap format, with the PPI headers. This version of the pcap log can only handle Wi-Fi packets, and manipulates the packet headers to fit the PPI standard (only one antenna signal value and other limitations). Generally the
pcapngformat should be used, but not all tools understand the new format.
pcapngis the modern pcap standard supported by wireshark, tshark, and other tools.
Pcap-ng allows for mixing packet types (such as Wi-Fi, BTLE, and Zigbee) as well as retaining the original capture interface (which datasource in Kismet saw the packet), the original headers (pure radiotap packet headers with more complete signal info, timestamps, etc). It also allows Kismet to log the packet without manipulation (such as header translation to PPI), allows for annotations, other data, and more.
Kismet can record duplicate packets when multiple datasources capture the same data. In some instances, keeping duplicate packets is desirable (such as remote captures used for device location), while in others, logging duplicates may be a waste of space.
Kismet typically logs all types of packets. To discard data packets, retaining only management frames: