Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- kismet [2008/08/25 20:43] – angelegt gerald
+++ kismet [2024/02/29 13:36] (aktuell) – Externe Bearbeitung 127.0.0.1
@@ Zeile 17: / Zeile 17: @@
 wlanconfig ath0 create wlandev wifi0 wlanmode monitor
 ifconfig ath0 up</code>
+airmon-ng geht auch:
+<code> It depends on which driver you are using. For all drivers except madwifi-ng:
+ airmon-ng stop <interface name>
+For madwifi-ng, first stop ALL interfaces:
+ airmon-ng stop athX
+Where X is 0, 1, 2 etc. Do a stop for each interface that iwconfig lists.
+Then:
+wlanconfig ath create wlandev wifi0 wlanmode sta</code>
 <code>kismet -c madwifi_g,wifi0,madwifi</code>
+----
+Sources:
+<code> Source type     Cards               OS          Driver
+    --------------- ------------------- ----------- -------------------------
+    acx100          TI ACX100           Linux       ACX100
+                    http://acx100.sourceforge.net/
+                    ACX100 drivers handle the 22mbit cards branded by D-Link
+                     and others.
+    admtek          ADMTek              Linux       ADMTek
+                    http://www.latinsud.com/adm8211/        (Patches)
+                    http://aluminum.sourmilk.net/adm8211/   (GPL driver)
+                    ADMTek drivers used in many consumer 802.11b cards. With
+                     the patches above, quasi-rfmon is possible - these cards
+                     appear to be almost entirely software controlled and
+                     always in a rfmon-like state.  This card WILL BROADCAST
+                     while in rfmon, rendering the sniffer visible.
+                    The fully GPL drivers are supported, in addition to the
+                     hacks to the non-free drivers.
+    airpcap         Airpcap USB         cygwin      CACE Tech
+                    http://www.cacetech.com/products/airpcap.htm
+                    The CACE AirPcap USB device allows native capture on
+                     Win32/Cygwin.
+                    The explicit airpcap source expects the Win32/Cygwin
+                     interface name.  This should be used once the source
+                     is identified via airpcap_ask or if multiple simultaneous
+                     sources are required.
+    airpcap_ask     Airpcap USB         cygwin      CACE Tech
+                    http://www.cacetech.com/products/airpcap.htm
+                    The CACE AirPcap USB device allows native capture on
+                     Win32/Cygwin.
+                    The airpcap_ask source lists available airpcap devices
+                     and allows the user to pick interactively.
+                    The 'capture interface' field is irrelevant and can be
+                     filled with any value (for example, 'dummy')
+    atmel_usb       Atmel-USB           Linux       Berlios-Atmel
+                    http://at76c503a.berlios.de/
+                    These drivers work ONLY on USB cards (Sorry, no PCMCIA
+                     support).  Monitor mode support is limited and "faked"
+                     by bypassing part of the firmware and parsing packets
+                     directly, and is likely to not report all of the
+                     frames.
+                    This card MAY BROADCAST while in rfmon, rendering the
+                     sniffer visible.
+                    It appears that this card may be only formatting the
+                     beacons as an 802.11 stream, which means you likely
+                     will not see data frames, rendering most IDS functions,
+                     IP discovery, and data logging unavailable.
+    ath5k           Atheros             Linux       Kernel/Madwifi
+                    http://madwifi.org
+                    Based on the OpenBSD OpenHAL, the Ath5k drivers are the
+                     future of Atheros support and will be mainlined into the
+                     Linux kernel.
+    ath5k_a         Atheros             Linux       Kernel/Madwifi
+                    http://madwifi.org
+                    Ath5k source for 11a only
+    ath5k_ag        Atheros             Linux       Kernel/Madwifi
+                    http://madwifi.org
+                    Ath5k source for 11a/11g
+    bcm43xx         Broadcom            Linux       BCM43XX
+                    http://bcm43xx.berlios.de, kernel
+                    Linux native broadcom drivers incorporated into modern
+                     kernels.
+    b43             Broadcom            Linux
+                    B43 broadcom drivers for current Broadcom devices in
+                     Linux kernels
+    b43legacy       Broadcom            Linux
+                    B43 broadcom drivers for legacy Broadcom devices in
+                     Linux kernels
+    cisco           Aironet 340,350     Linux       Kernel 2.4.10 - 2.4.19
+                    Standard Cisco cards in Linux.  Works only with
+                     the Linux kernel drivers, not the drivers found in
+                     pcmcia-cs.
+                    The drivers found on the cisco.com site can be patched
+                     with the files from the Kismet download site to add
+                     monitor mode with channel control, HOWEVER these drivers
+                     are extremely buggy for normal use and work only with
+                     the 2.4 kernel tree.
+                    The cisco drivers currently do not enter rfmon mode
+                     correctly, so channel control is not available.  The
+                     firmware will hop to whatever channel it feels like
+                     hopping to, when it feels like hopping.
+    cisco_wifix     Aironet 340,350     Linux       Kernel 2.4.20+, CVS
+                    http://sourceforge.net/projects/airo-linux/
+                    Capture interface:  'ethX:wifiX'
+                    Kernel 2.4.20+ and CVS drivers use ethX for normal mode
+                     and wifiX for monitor mode.  Kismet needs to know both
+                     devices, which may not necessarily be the same number,
+                     for example 'eth1:wifi0'.
+                    Linux kernel 2.4.20 and 2.4.21 have highly unstable cisco
+                     drivers and should be avoided.
+                    The cisco drivers currently do not enter rfmon mode
+                     correctly, so channel control is not available.  The
+                     firmware will hop to whatever channel it feels like
+                     hopping to, when it feels like hopping.
+    darwin          OSX native cards    OSX/Darwin  OSX
+                    Supports both Broadcom and Atheros Airport-Extreme cards.
+                    When using a Broadcom based card, it may be necessary to
+                     enable rfmon on the device for the first time using another
+                     program.
+                    When using an Atheros based card, 802.11a may also be supported
+                     by adding a 'sourcechannels' line to kismet.conf.
+    hostap          Prism/2             Linux       HostAP 0.4
+                    http://hostap.epitest.fi/
+                    HostAP drivers drive the Prism/2 chipset in access point
+                     mode, but also can drive the cards in client and monitor
+                     modes.  The HostAP drivers seem to change how they go
+                     into monitor mode fairly often, but this source should
+                     manage to get them going.
+    ipw2100         Intel/Centrino      Linux       ipw2100-0.44+
+                    http://ipw2100.sourceforge.net/
+                    The Linux IPW2100/Centrino drivers for 802.11b cards
+                    now support rfmon, so here's support for them.  They act
+                    more or less like any other wireless interface would.
+    ipw2200         Intel/Centrino      Linux       ipw2200-1.0.4+
+                    http://ipw2200.sourceforge.net/
+                    The Linux IPW2200/Centrino drivers for 802.11bg cards
+                    support rfmon as of 1.0.4 and firmware 2.3.
+                    Signal level reporting requires radiotap be turned on
+                    in the makefile while compiling the driver.  Noise levels
+                    are not reported.
+    ipw2915         Intel/Centrino      Linux       ipw2200-1.0.4+
+                    http://ipw2200.sourceforge.net/
+                    The Linux IPW2200/Centrino drivers for 802.11bga cards
+                    support rfmon as of 1.0.4 and firmware 2.3.
+                    This is the same as ipw2200 but defaults to scanning the
+.11a channel range in addition to 802.11b/g.
+                    Signal level reporting requires radiotap be turned on
+                    in the makefile while compiling the driver.  Noise levels
+                    are not reported.
+    ipw3945         Intel/Centrino      Linux       ipw3945
+                    http://ipw3945.sourceforge.net/
+                    The Linux IPW3945/Centrino drivers for Intel Core
+.11bga cards.
+    ipwlivetap      Intel/Centrino      Linux       ipw2200/3945
+                    http://ipw2200.sourceforge.net/
+                    http://ipw3945.sourceforge.net/
+                    The ipw3945 and patched ipw2200 drivers support a
+                    special mode which allows monitor-mode style sniffing
+                    while remaining associated.  Channel hopping is not
+                    possible, as the card is still associated to a
+                    specific AP, but single-channel IDS and sniffing can
+                    be accomplished.  See the ipw driver mailing list
+                    archives for information about patching your drivers.
+    iwl3945         Intel/Centrino      Linux       iwl3945
+                    Intel's new IPW drivers using the mac80211 kernel
+                    layer.
+    iwl4965         Intel/Centrino      Linux       iwl4965
+                    Intel's new IPW drivers using the mac80211 kernel
+                    layer.
+    kismet_drone    n/a                 Any         n/a
+                    Capture interface:  'dronehost:port'
+                    The remote drone capture source connects to a Kismet
+                     drone and processes the packets.  Refer to the Remote
+                     Drone section of the README for more details about how
+                     to set up a drone.
+    madwifi_a       Atheros             Linux       madwifi
+                    http://sourceforge.net/projects/madwifi/
+                    Capture interface:  'athX'
+                    Capture interface:  'wifiX' (Madwifi-NG)
+                    Madwifi drivers in 802.11a-only mode.
+                    When using madwifi-ng, be sure all non-monitor VAPs have
+                     been removed, otherwise madwifi will not properly report
+                     most traffic.
+    madwifi_b       Atheros             Linux       madwifi
+                    http://sourceforge.net/projects/madwifi/
+                    Capture interface:  'athX'
+                    Capture interface:  'wifiX' (Madwifi-NG)
+                    Madwifi drivers in 802.11b-only mode.
+                    When using madwifi-ng, be sure all non-monitor VAPs have
+                     been removed, otherwise madwifi will not properly report
+                     most traffic.
+    madwifi_g       Atheros             Linux       madwifi
+                    http://sourceforge.net/projects/madwifi/
+                    Capture interface:  'athX'
+                    Capture interface:  'wifiX' (Madwifi-NG)
+                    Madwifi drivers in 802.11g-only mode.  This will,
+                     obviously, also see 11b networks.
+                    When using madwifi-ng, be sure all non-monitor VAPs have
+                     been removed, otherwise madwifi will not properly report
+                     most traffic.
+    madwifi_ab      Atheros             Linux       madwifi
+                    http://sourceforge.net/projects/madwifi/
+                    Capture interface:  'athX'
+                    Capture interface:  'wifiX' (Madwifi-NG)
+                    Madwifi drivers in 802.11a and 802.11b combo mode.  This
+                     will seamlessly switch between bands during channel
+                     hopping.
+                    When using madwifi-ng, be sure all non-monitor VAPs have
+                     been removed, otherwise madwifi will not properly report
+                     most traffic.
+    madwifi_ag      Atheros             Linux       madwifi
+                    http://sourceforge.net/projects/madwifi/
+                    Capture interface:  'athX'
+                    Capture interface:  'wifiX' (Madwifi-NG)
+                    Madwifi drivers in 802.11a and 802.11g combo mode.  This
+                     will seamlessly switch between bands during channel
+                     hopping.
+                    When using madwifi-ng, be sure all non-monitor VAPs have
+                     been removed, otherwise madwifi will not properly report
+                     most traffic.
+    madwifing_a     Atheros             Linux       madwifi-ng
+    madwifing_ab    Atheros             Linux       madwifi-ng
+    madwifing_ag    Atheros             Linux       madwifi-ng
+    madwifing_g     Atheros             Linux       madwifi-ng
+    madwifing_b     Atheros             Linux       madwifi-ng
+                    http://sourceforge.net/projects/madwifi/
+                    Capture interface:  'wifiX'
+                    *Deprecated*.  Detection for madwifi-ng is built into
+                     the standard madwifi sources.  The _ng source names
+                     have been kept to allow old configs to continue
+                     functioning.
+    nokia770        Nokia               Linux       Nokiea
+                    http://maemo.org/
+                    Nokia770 capture interface.  Includes support for
+                    validating frame checksums to screen out junk
+                    packets, since the drivers pass us all data.
+    nokia8x0        Nokia 800,810
+                    http://maemo.org/
+                    Nokia 8x0 capture interface, including support for
+                    FCS validation.
+                    The Nokia drivers appear to exhibit instability while
+                    capturing where they stop reporting packets.  This may
+                    be minimized by setting the Network Scan interval to
+                    "never" in the control panel->networking section.
+    orinoco         Lucent, Orinoco     Linux       Patched orinoco_cs
+                    http://airsnort.shmoo.com/orinocoinfo.html
+                    The Orinoco drivers which have mainlined into the Linux
+                     kernel do support monitor mode, however only specific firmware
+                     versions are supported and often they do not work.
+                    An up-ported version of the older Orinoco drivers which more
+                     reliably supported rfmon may be available at:
+                     http://www.projectiwear.org/~plasmahh/orinoco.html
+                    Generally, Orinoco cards are not recommended for use with
+                     Kismet due to these limitations.
+    orinoco_14      Lucent, Orinoco     Linux       Orinoco 0.14+
+                    https://savannah.nongnu.org/projects/orinoco/
+                    This source is deprecated and should only be used with
+                    pre-release versions of a driver since merged into the Linux
+                    kernel.
+    pcapfile        n/a                 Any         n/a
+                    Capture interface:  '/path/to/file'
+                    The pcapfile capture source feeds a stored 802.11-encap
+                     dump file through the Kismet engine again.  This can be
+                     useful for debugging or rescanning old logs for
+                     alert conditions.  Pcapfile sources are only available
+                     if Kismet was compiled with libpcap support.
+    prism2_openbsd  Prism/2             OpenBSD     Kernel
+                    Full support for Prism2 under OpenBSD.
+    prism54g        PrismGT             Linux       prism54
+                    http://www.prism54.org
+                    PrismGT 802.11g drivers supporting monitor mode.
+    radiotap_bsd_ab Radiotap            BSD         Kernel
+                    Dual-band cards with radiotap headers.
+    radiotap_bsd_a Radiotap              BSD        Kernel
+.11a cards (or dual-band on 11a channels only) with
+                     radiotap headers.
+    radiotap_bsd_b Radiotap             BSD         Kernel
+.11b/g cards (or dual-band on 11b channels only) with
+                     radiotap headers.
+    rt2400          Ralink 2400 11b     Linux       rt2400-gpl
+                    http://rt2x00.serialmonkey.com/
+                    Ralink 2400 802.11b cards using the serialmonkey GPL'd
+                     rt2x00 drivers.  Must use 1.2.2 beta 2 or newer drivers.
+    rt2500          Ralink 2500 11g     Linux       rt2500-gpl
+                    http://rt2x00.serialmonkey.com/
+                    Ralink 2500 802.11g cards using the serialmonkey GPL'd
+                     rt2x00 drivers.  Must use 1.1.0 beta 2 or newer drivers.
+    rt73            Ralink 73   11g     Linux       rt73-gpl-cvs
+                    http://rt2x00.serialmonkey.com/
+                    Ralink 73 802.11g USB cards using the serialmonkey GPL'd
+                     rt79 drivers (tested only with CVS driver versions)
+    rt8180          Realtek 8180 11b    Linux       rtl8180-sa2400
+                    http://rtl8180-sa2400.sourceforge.net/
+                    Realtek 8180 based cards (there seem to be an awful lot of
+                     them) using the GPL drivers.
+    viha            Airport             OSX         viha
+                    http://www.dopesquad.net/security/
+                    Monitor mode support for Airport under OSX.  Does not
+                     support Airport Extreme.
+    vtar5k          Atheros 802.11a     Linux       vtar5k
+                    http://team.vantronix.net/ar5k/
+                    vtar5k drivers handle some Atheros 802.11a cards.  Chances
+                     are you'll have better luck with madwifi drivers.
+    wlanng_legacy   Prism/2             Linux       wlan-ng 0.1.3 and earlier
+                    http://www.linux-wlan.com/
+                    Old wlan-ng drivers didn't support pcap capturing and
+                     use a netlink socket to the kernel.  These are still in
+                     use on some embedded systems (like the Zaurus).
+    wlanng          Prism/2             Linux       wlan-ng 0.1.4 - 0.1.9
+                    http://www.linux-wlan.com/
+                    Wlan-ng prism2 drivers prior to the AVS headers.
+    wlanng_avs      Prism/2             Linux       wlan-ng 0.2.0+
+                    http://www.linux-wlan.com/
+                    Newer wlan-ng drivers support a new header type and
+                     slightly different monitor commands to report wepped
+                     packets.
+    wrt54g          Linksys WRT54G      Linux       linksys
+                    http://seattlewireless.net/index.cgi/LinksysWrt54g
+                    Capture interface:  'wlX'
+                    Support for the newer firmware versions on the
+                     WRT54G/S/L devices (and any others using the broadcom
+                     reference chipset).
+                    Some systems generate a secondary device, prism0, while
+                     in monitor mode and require special care while channel
+                     hopping, it is no longer necessary to specify the prism0
+                     device explicitly for Kismet.
+    wsp100          NetChem WSP100      Any         n/a
+                    http://networkchemistry.com/
+                    Capture interface:  'host:port'
+                    The WSP100 is an embedded device which reports 802.11
+                     packets over UDP.  The wsp100 capture source is
+                     (generally) system agnostic, however over time it has
+                     been less maintained than others.  If you'd like to
+                     send me patches for this, please let me know.
+    zd1211          ZyDAS USB           Linux       zd1211
+                    http://zd1211.ath.cx
+                    The ZD1211 drivers have had some regressions which lead to
+                     data corruption while changing channel.  Some versions
+                     work, and typically the aircrack patches resolve the
+                     corruption issues if your version doesn't properly handle
+                     rfmon.
+    Chipsets known to NOT WORK:
+     Broadcom           - No linux drivers, only useable with ndiswrapper or
+                          linuxant wrappers around windows drivers.
+                          *** UPDATE ***
+                          See the bcm43xx source type entry.  There are
+                          experimental reverse-engineered drivers which have
+                          monitor mode support now under Linux!  If they don't
+                          work, however, then too bad.
+     Airport Extreme    - Really a Broadcom, with no rfmon in the OSX drivers.
+                          *** UPDATE ***
+                          See the bcm source for linux on ppc, it MAY work, it
+                          may not.  Currently theres no solution for OSX but
+                          I'm looking for OSX hackers interested in redoing the
+                          Kismet port and looking into adding more support.
+     Atmel              - There is a hack for pseudo-monitor in USB.  There is
+                          currently no equivalent hack for PCMCIA.
+     HermesII           - Proxim successor to the Orinoco/HermesI.  No support
+                          yet in the drivers, may be available in the future.
+     ndiswrapper        - Anything using ndiswrapper is using WINDOWS drivers
+                          AND CAN NOT BE USED WITH KISMET.</code>

Nach oben

kismet.1219696983.txt.gz · Zuletzt geändert: 2024/02/29 13:35 (Externe Bearbeitung)

Übersicht Letzte Änderungen

Admin