Secure Ideas actively supports open source and giving back to the community. In that light, we’re announcing the release of an updated tool for parsing and viewing Kismet log files.
Kismet is a fantastic tool for wireless network assessments. It passively detects networks, SSIDs, and with enough time can even decloak hidden networks by capturing the name from clients that connect. And with an extensible plugin architecture, it can even sniff other, non-802.11, types of wireless traffic.
One common use during a wireless assessment is to walk or drive the facilities of a client to determine what wireless traffic is actually being used. Then that information can be compared to documentation of what the client believes should be in use. Often we find misconfigurations, unapproved use, and even unauthorized devices that have been added to the network.
One area that Kismet stumbles though is the ability to easily review log files after the assessment. During the assessment, viewing data and activity is very easy and accessible, but later when you’re trying to analyze the results it’s more difficult. Kismet creates a LOT of log data, and most of it is in XML or CSV format that makes it easy to parse, but there is no native functionality to view those logs.
Several years ago a number of tools had been released that parsed and presented this log data in an easy-to-read HTML format. Unfortunately with changes to the Kismet structure and log format, none of those tools still work correctly.
To remedy that, we released Kismet Log Viewer v2, an update to the original Kismet Log Viewer released by Brian Foy in 2003. KLV v2 reads in multiple Kismet .netxml files, summarizes the data, and outputs an HTML or CSV file.
This initial release has some limitations. Like most development, functional priority was based on necessity; I wrote what I needed first. But I plan to continue extending the tool to add more functionality.
Need a wireless security assessment?
Our team performs wireless penetration tests including rogue access point detection, network enumeration, and traffic analysis. Reach out to discuss an engagement.
