Kismet on the Linksys WRT54G
The little Linksys WRT54G box is a terrific generic Linux platform to run just about any networking code on. I have found that the radio on it when cranked up to its full 84mw is better than any of my pcmcia cards including the 100mw Cisco-350 I normally use when I need to pick up some distant signal. I have this 5dbi Maxrad antenna I normally use with the Cisco card and even with that it doesn't match the sensitivity of the WRT54G with the stock antennas. I also picked up a dual diversity flat-patch antenna from Hyperlink to see if I could extend my packet detection range a bit. There is a picture of it in the extended entry. Also note the updated section at the end of the 54G and no Wires post.
For those that haven't run across it before, Kismet is a very handy 802.11 monitoring program which is used to detect wireless activity. There is a MIPS binary for kismet_drone and kismet_monitor at http://gattaca.ru/~nikki/wrt54g/kismet.tar.bz2. To get it up and running, first you need command-line access to your gateway. I suggest sticking this firmware on it. Just unzip and use the standard "upgrade firmware" option to switch to it. Reboot the box and under the Administration menu turn on telnet and under the wireless menu put it into Client mode. Uncompress the kismet tarball on some machine, telnet into the gateway and from /tmp either scp or wget the files into /tmp/kismet/bin and /tmp/kismet/etc. Edit the /tmp/kismet/etc/kismet_drone.conf file and make sure you pick the right source ethernet device based on your wrt version. For version 1.0 and 1.1 use eth2 and for a v2 gateway, use eth1.
# WRT v1, v1.1 source=wrt54g,eth2,wrt54g # WRT v2 #source=wrt54g,eth1,wrt54gTo run it, first make sure you are not associated with a gateway already. It will actually still work, but it won't channel hop automatically. Also a good idea to make sure you don't send out any probes by sticking it into passive mode. I would suggest these steps:
wl disassoc wl passive wl scan wl scanresultsThe scan and scanresults is just to get a sense of whether there is anything out there. It will tell you if it sees any gateways and what their signal strengths (rssi) are. Here is the typical output from one of my gateways:
# wl scan # wl scanresults SSID: "Canada" Mode: Managed RSSI: -40 dBm noise: -82 dBm Channel: 3 BSSID: 00:06:25:C5:32:21 Capability: ESS WEP ShortSlot Supported Rates: [ 1(b) 2(b) 5.5(b) 11(b) 18 24 36 54 6 9 12 48 ] SSID: "Canada" Mode: Managed RSSI: -71 dBm noise: -82 dBm Channel: 3 BSSID: 00:0C:41:D3:99:E1 Capability: ESS WEP ShortSlot Supported Rates: [ 1(b) 2(b) 5.5(b) 11(b) 18 24 36 54 6 9 12 48 ]Now to run the drone, do this:
/tmp/kismet/bin/kismet_droneYou should see something like this:
Suid priv-dropping disabled. This may not be secure. No specific sources given to be enabled, all will be enabled. Enabling channel hopping. Disabling channel splitting. Source 0 (wrt54g): Enabling monitor mode for wrt54g source interface eth2 channel 6... Source 0 (wrt54g): Opening wrt54g source interface eth2... Kismet Drone 3.1.0 (Kismet) Listening on port 3501 (protocol 8). Allowing connections from 192.168.0.0/255.255.0.0And now on your Linux box which should be connected directly to one of the switch ports on the gateway with an appropriate ip allocated for both gateway and Linux box, of course, find your kismet.conf file and put this in it:
source=kismet_drone,192.168.1.3:3501,droneNow you are ready to fire up kismet. If everything worked and there are gateways out there you should see something like this:
Here you see my two other wrt gateways each with an essid of Canada, an mlife access point somewhere, one named WesClark(?!) and one named default. The colours indicate if they are using encryption and generally how secure they might be. Green means encryption is used, yellow means no encryption, but at least the default config has been changed in some way so it may not be trivial to access it and red means a gateway which is still running with its default wide-open config.
Here is the WRT with the Hyperlink antenna pointing out a window.
Trackbacks
No Trackbacks
Comments
Display comments as Linear | Threaded
Mike Dolan on :
arias on :
Hey rasmus, i was wondering what you thought of the linksys wsb24, and why you chose to get a directional hyperlink antenna over getting an amplifier that would rock your baby wrt54g's
OUT with an extra 14dbm average?
Icecold on :
Daedaleus on :
Suid priv-dropping disabled. This may not be secure.
No specific sources given to be enabled, all will be enabled.
Enabling channel hopping.
Disabling channel splitting.
Source 0 (wrt54g): Enabling monitor mode for wrt54g source interface eth2 channel 6...
Source 0 (wrt54g): Opening wrt54g source interface eth2...
FATAL: ioctl: No such device
arias on :
RTFM!!!
It starts by learning unix ...
Todd on :
Anyone know much about it-can I use it?
Todd
jagottsicher on :
Pinnocchio on :
As I'm not a Linux person I had problems with the SCP part......this pagelink sorted it out for me and would be very useful if incorporated into this page.
http://scalnet.zapto.org/wakka.php?wiki=SamaDhi2
roadknight on :
Here's what I get when I try to scp the kismet bits over:
# scp 192.168.16.37:/Volumes/Opt/kismet/bin/kismet_monitor /tmp/kismet/bin/kismet_monitor
/usr/bin/ssh: illegal option -- x
usage: scp [-pqrvBC1246] [-F config] [-S program] [-P port]
[-c cipher] [-i identity] [-l limit] [-o option]
[[user@]host1:]file1 [...] [[user@]host2:]file2
#
Huh???
I'm not typing -x !
How do I get around this?
lefty2446 on :
man scp
q to quit when you have the knowledge.
scp /path/to/source/file username@destination_host:/path/to/destination/file
You will be promped for the password, copy one file at a time.
Lefty
manys on :
tcarlson on :
troy the wonder ape on :
David Smith on :
Any help would be appreciated.
maskofconcern on :
Email me jon@ my domain, or catch me on AIM as maskofconcern if you have any useful info. Thanks!
pashan on :
by ssh from laptop under debian (kismet) to windows2000.
howto http://scalnet.zapto.org/wakka.php?wiki=KisMet
wrt54g v1.1 firmware openwrt + laptop debian 2.2 woody(kismet-2004-04-R1)
Phil on :
There's nothing a booster can do that a well placed and designed antenna can't. Using less power means less interference on the already crowded 2.4 band.
Troy on :
doug on :
Wireless-> Basic Settings->Wireless Mode. I hope this helps.
Matt on :
First off: My particular WRT54g model with v2.02.2 firmware doesn't have the "client" setting. Furthermore, loading BuzzBox distro on it just to get a command-line prompt didn't help any...in fact, I couldn't set it into client mode via command-line at all. I was actually able to persuade it to go into Ad-Hoc mode to at least let me perform command-line scans, but kismet wouldn't run.
I eventually switched to the EWRT firmware (http://www.portless.net/ewrt/) and was able to get the router to turn off AP mode, scan and do all the normal stuff as well as start the drone without the "eth1" error (which I am assuming is a result of periodic scan requests coming from kismet to the router interface, which is stuck in AP mode).
The second issue folks may want to know about is that this particular precompiled build of the kismet_drone the author posted here is built from the development tree. If you get the stable version of the server (v3.0.1) you won't be able to talk to it.
Rasmus on :
Luke on :
Brad Isbell on :
I'm trying to figure this out so I can come up with a way to get my wap54g to channel hop. It will run the official mips kismet binaries, but they don't channel hop. When I run your binary, it throws a segmentation fault.
Don on :
Brad Isbell on :
Eran on :
That's until I tried doilg wl ap 0 - to get it out of ap mode.
Then wl disassoc still returned an error BUT wl scan didn't.
Let me know if it helped you.
UOF on :
But it sounds easier as it is because I found no 'wl' command (ver. 2) that is usefull for channelhopping while kismet runs. Okay you can get some results with 'wl scan' and 'wl scanresults' but thats completly independent of kismet. Also I had problems with the drone running on the box - better results with the kismet server, but not satisfing, too...
Any ideas (except of troycicles) are very welcome ...
UOF
Brad Isbell on :
Right now I've got a program that telnets into it and runs wl channel commands on it every 100ms. Works great, but kismet doesn't know what channel it's on. Not a total loss though. I'm convinced though there has to be a way for kismet to be able to get it to hop on it's own. If you scroll up, you see in the log posted that says enabling channel hopping. I'm curious how that was done.
Anonymous on :
Thougt of a script, too. But there has to be a way to exec it without the need of any kind of remote connection to the box... Damn think I have to reanimate my rusty C-skills grmpf ...
Brad Isbell on :
Anonymous on :
here is the code:
#!/bin/ash
/usr/sbin/wl disassoc
/usr/sbin/wl ap 0
/usr/sbin/wl passive 1
while true
do
for i in 7 14 2 13 3 9 12 4 11 5 10 6 1 8 do
/usr/sbin/wl channel $i /usr/sbin/wl channel
sleep 1
done
done
to activate per remote, or by cron, or init ... works real fine under openwrt...
regards
uof
p.s. this forum isnt realy good for possting code ...
uof on :
on sveasoft you have to deactivate channel 14 - dunno why.
AND of course, if you are located in the states, you have to remove the channels 12, 13 and 14 ...
regs
uof
Chris on :
uof on :
Reid on :
Thanks again
Bob on :
TIA, -bob
Rasmus on :
saed Hamad on :
Can you send me those step by step instructions for tweaking the signal
Email To saed1@earthlink.net
Brad Isbell on :
Step Two: Search for wrt54g or wap54g depending on what box you're working on.
Step Three: Read one of the many pages of information that result. Especially check the search results mentioning seattle wireless.
Marc on :
I'm trying to get Kismet to work on my WRT54G V2 with the latest free (Satori 4.0G) firmware from Sveasoft and Kismet server 3.0.1 on a Debian box.
I've tried the kismet binary linked-to in the orig. post above as well as the mips binary available from kismetwireless.net.
Drone always appears to start-up fine on the wrt54g, but when I start-up the kismet server on my Debian box, I get errors on both the drone and server side.
Kismet server reports:"FATAL: capture child 15659 packet buffer empty and flagged as diseased, exiting", while Kismet_Drone reports:"Accepted streamer connection from 192.168.2.10
WARNING: Killing client fd 6 read error 0: Success". Any guidance would be appreciated. Thanks, Marc.
Ihatemyjob on :
flip on :
In this version.. when you run "wl scan".. it automatically re-associates with the last SSID joined so that you can 'survey' and not kill your client mode..
Does anyone have Kismet working with wolf's alchemy?
drew on :
flip on :
wget http://whatever-url/
Cware on :
I have the V 1.1 and already installed kismet on it. Did the Client Mode too. After that I dont have a error message BUT: I dont have any scanresults and Im sure Im surrounded by some networks - I was checking It with kismet on my notebook...
So whats the problem ? Next thing - I cant start kismet_drone "No such file or directory" is the answer...
Thanx for helping...
Fungifred on :
what can I do to get it to run?
Fungifred on :
Khan on :
pelesmk on :
pelesmk on :
scuba303 on :
disassoc =>eth1: Invalid argument
problem solved? do i have to set the router to ap, client or whatever mode?
dev|ant on :
mykl on :
maskofconcern on :
while true
do
wl scan 2>/dev/null
sleep 1
done
Any thoughts?
Brad Isbell on :
Sebastian on :
/tmp/kismet/bin # ./kismet_drone
Suid priv-dropping disabled. This may not be secure.
No specific sources given to be enabled, all will be enabled.
Enabling channel hopping.
Disabling channel splitting.
Source 0 (wrt54g): Enabling monitor mode for wrt54g source interface eth1 channe
l 6...
Source 0 (wrt54g): Opening wrt54g source interface eth1...
FATAL: pcap reported netlink type 1 (EN10MB) for eth1. This probably means you'
re not in RFMON mode or your drivers are reporting a bad value. Make sure you h
ave the correct drivers and that entering monitor mode succeeded.
/tmp/kismet/bin #
ignasi on :
I'm using the Alchemy-pre5.4a firmware from sveasoft.
Any suggestions, ideas??
Thanks.
Sebastian on :
then all will work fine,
metalo on :
Anojan on :
wl monitor 0
wl monitor 1
Brad Isbell on :
http://www.musatcha.com/computers/software/wifimapping/
mike on :
linus box side failed reset ui server :tcp server ..()failed: addresse already in use
mike on :
alowing connections from 127.0.0.1/255.255.255.255
faile to set up ui server: Tcpserver bind() failed address already in use
from wrt54g
warning: killing client fd 5 read error 131: connection reset by peer
Paul on :
What I would like to do is deploy these as Kismet remote drones and connect to them across a WAN, but, whenever I enable the Linksys as a "Client" in AP mode, it disables routing and I am unable to contact the Linksys remotely.
Any suggestions or ideas on how to make this work?
Paul on :
Am I missing something or is there a way to save this permanently to the Linksys' NVRAM?
Brad Isbell on :
Phil on :
WARNING: Setting driver in STA mode to enable channel hopping
as the last time before looking like it's scanning).
I then try to connect from my FreeBSD machine with Kismet and on the drone's side I get -
Accepted streamer connection from 192.168.0.3
WARNING: Killing client fd 5 read error 25: Inappropriate ioctl for device
On the client side, I get a FATAL error about not having permission to open the dump file (don't really care about that at this point) and I also get this before it closes -
WARNING: drone (192.168.0.254:3501) unable to exit monitor mode automatically. You may
need to manually restart the device and reconfigure it for normal
operation.Kismet exiting.
mike on :
Wiskey Gord on :
Mike Strates on :
You write:
"I have found that the radio on it when cranked up to its full 84mw is better than any of my pcmcia cards including the 100mw Cisco-350 I normally use when I need to pick up some distant signal."
Although "wl -h" shows the txpwr command's values as being between 1-84, you can actually beef it up to 251 mw. (You can get it to 255 mw if you REALLY want to - email me if you're curious.)
Just issue the command:
wl txpwr 251
And volia. You can confirm it by typing
wl txpwr
and it will tell you that, indeed, it has been set to 251. (If you type something ridiculous in there, like wl txpwr 380 - it will accept it, but if you go wl txpwr to confirm, you'll see that it hasn't.)
If you thought 84 mw performance was good, wait until you see this.
Kind Regards,
-Mike.
Rasmus on :
pelesmk on :
dano on :
Brad Isbell on :
Mondo1287 on :
cat | nc 23
cd /tmp
mkdir kismet
cd kismet
mkdir bin
mkdir etc
cd etc
wget http:///kismet/kismet_drone.conf
cd ../bin
wget http:///kismet/kismet_drone
wget http:///kismet/kismet_monitor
chmod +x kismet_drone
wl disassoc
wl passive 1
./kismet_drone
Mondo1287 on :
It should be cat "file with commands" | nc "wrt54g ip" 23
and http://"your server ip"/....
Justin Jones on :
It re-organizes the wl scanresults output nicely and adds a little bar graph to see from across the room while you adjust your antenna.
Easiest way is to telnet into your client, type 'cat - >scanner' paste in the code below, then hit enter and then a ctrl-c. run with
awk -f scanner.
#copy here to end
BEGIN{
#by Justin Jones - do with as you wish
command = "wl scan 2> /dev/null ; wl scanresults 2> /dev/null";
red = "\x1b[31m"; green = "\x1b[32m";
greenback="\x1b[42m"; yellow = "\x1b[33m";
cyan = "\x1b[36m"; blue = "\x1b[34m";
blueback = "\x1b[44m"; white = "\x1b[37m";
whiteback = "\x1b[47m"; reset = "\x1b[0m";
underscore = "\x1b[4m"; clear = "\x1b[2J";
home = "\x1b[0;0H"; erase2end = "\x1b[K";
cName = white; cSignal = green;
cNoise = red; cCaps = green;
cStrengthLow = blue blueback; cChannel = green;
cStrengthMed = white whiteback;
cStrengthHi = green greenback;
cStrengthAged = red;
print clear;
for(;;)
{
while (command|getline)
{
if(/^SSID/) {cn = $2; name[cn] = cn; rssi[cn] = $6;noise[cn]= $9}
if(/^Mode/) {rssi[cn] = $4;noise[cn]= $7; channel[cn] = $10 }
if(/^BSSID/) {caps[cn] = $4" "$5" "$6" "$7" "$8" "$9" "$10 }
}
close(command)
printf home;
ln = 0;
print white " Name Signal Noise Channel Type";
for (x in name)
{
sigstrength = ((rssi[x] - noise[x])*1.5) + ((rssi[x] +90)*1.5);
if (sigstrength 4) cStrength = cStrengthMed;
if(sigstrength>7) cStrength = cStrengthHi;
if(age[x]=0) cStrength = cStrengthAged;
fmt = "%s%-15s %s%0"sigstrength"d "reset erase2end "\n %s%-4d %s%-4d %s%-4d %s%2s %s%10s " reset erase2end "\n" erase2end "\n";
printf fmt, cName,name[x],cStrength,0,cSignal,rssi[x],cNoise,noise[x],cChannel, channel[x],cCaps,caps[x];
rssi[x] = -100;
ln++;
}
print erase2end;
}
}
Asem on :
Now I don't know how to connect to any of the detected networks (many of them without WEP).
I don't know which nvram variables I need to set on my WRT so that I can connect (and use internet ;)).
My setup:
- Debian machine running Kismet (client & server).
- connected through LAN port to a WRT54G v2.2 (running kismet_drone and openWRT).
Brad Isbell on :
ryan on :
scoove on :
for instance, i've got a an uncloaked ap in the same room that wl picks up immediately. kismet_drone talks fine with my kismet config on my laptop, but sits there not reporting any aps. i've run the channelhopping scripts referenced above as well but it still reports nothing. any thoughts? thx!
scoove
Brad Isbell on :
kefir on :
Suid priv-dropping disabled. This may not be secure.
No specific sources given to be enabled, all will be enabled.
Enabling channel hopping.
Disabling channel splitting.
Source 0 (wrt54g): Enabling monitor mode for wrt54g source interface eth2 channel 6...
Source 0 (wrt54g): Opening wrt54g source interface eth2...
Kismet Drone 3.1.0 (Kismet)
Listening on port 3501 (protocol 8).
Allowing connections from 192.168.0.0/255.255.0.0
what now?
What should I change ?
Please help me..
Brandon on :
charles on :
mike2 on :
Ralf on :
Eric on :
they have an excellent breakdown of hardware and pictures to boot for all the various versions and releases of the wrt54g and gs models... very helpful people too...
By the way - back to my point - browsing around I found a link to one of my fav shows (I must have missed this one) Tech TV - the screensavers - http://www.g4tv.com/screensavers/features/354/Dark_Tip_Linux_on_Linksys.html
who lightly touched on this whole crowd of ideas for linux on the wrt54g - they have links there which lead me to some great resources - INCLUDING THIS PAGE... wow! global exposure for you on there! Kudos!
-Eric
PS I've purchased a few very expensive access points with multi radio setups... the Strix OWS radios - Tempe, AZ WAZ metro (they covered the 40 square mile city with mesh networking and are using the STRIX units - I can see why)... I'd love to crack they propriatary firmware on their units for a smaller scale edge-client small mesh... imagine the possibilities if we could somehow port the capabilities of the strix units - which I believe are running on less hardware - but more of it and a lot more ruggidized - but imaine running a world class/carrier class (free community - my goal) WISP with QOS for VoIP and private vlans for segmented services (home users, business users, government) all on the wrt models?!! that would be a huge thing... (the ows units are severl thousand dollars each - but are the only TRUE mesh system capable of multihop and self healing bandwidth routing and remote management... - I am also using an AIRLOK (lok.com) for network services - spash portals, walled gardens, web/ftp/radius/ldap/mysql services - yeah there are ways to put nocatauth or something similar on the wrt for a simple splash authentication page - but the AIRLOK's openbsd's inherent security and a cute small form factor pc with amd64 high-speed processing power and openly available IDE (cheap) hard drives (the airlok uses maxtor - not my fav - but it works great!) and you have a really awesome network that ma bell would cry about...
this is my goal... use my strix stuff for the main backhauls to the smaller local mesh groups around the city and in business districts - of course up the ante with more in higher density areas - but share the net with everyone - for free - or have it sponsored by a city or chamber of commerce... It works - I've done it now with 2 strix units and 2 wrt's to testing - I made skype voip calls, google talk calls (never tried vonage) alongside 2 or 3 300k+bps downloads from various servers on east coast and west coast as well as from locally within the wireless WAN netowrk... flawless quality.... only problem is that I have not found a way to handle the "cell phone" style handshake of clients from one AP to the next - this has been solved with the strix units - affording for true seemless wen browsing and voip calling while moving from tower to tower ot AP coverage to the next... pretty neat stuff - it'd be neater if I could find some like minded folks with the time to help get the wrt to do this....
I see so many people trying to max out the servies on the wrt - see what else they can put on it... but I see that as just fun stuff... realistically in a commercial world if you want really use this exploit for cost savings or sharing - why not look at using it as an alternative to the higher priced APs and use it's 200mhz (GS models) with 32MB of RAM for quantifiable use - i.e. use it's power only as an AP by routing say 500+ users on that particular node in a mesh cluster - leave the web hosting, databases and bandwidth management up to a higher level linux box more easily managed - this enables you to have a very fast end/edge mesh cluster - add a single AP (like the strix) running a 5ghz backhaul (802.11a) to the main network for remote connectivity - and you can take over the world... just kidding.. but it's my idea that so far I am seeing many others have had similar ideas - but never all the pieces of the puzzle put together on how to do it... I have this now - all the equipment needed, the business models (or lack therof) the antenna modeling programs, (btw - for all of you just trying to figure out theoreticaly how far your signal will go - google "radio mobile" and download that FREE software - you can map everything in your neighborhood, state or world from several free databases online with elevation data and satellite images - I got very high resolution details on my neighborhood from the satellite immagery and elevation data - and was able to predict very closely the actual radiation patterns - and where I would need to increase power or directivity with panel/sector antennas, as well as calculate the line loss from various amplifiers, cables and lengths and other connectors - factoring that all into the links changes things significantly...
If any of you want to help - email me.... Eric@GoZippy.com
Other projects are to port the mesh network of wrt's to a CMS solution - like I said - not hosting the splash page on the wrt, rather directing traffic to a managed network would allow you to also route to a full web server where you could run a community portal site like Joomla, or Mambo or Drupal... all excelent cms solutions - I also like php-nuke and post-nuke...
I'm also working on porting a ACL to Joomla and possibly using radius or ldap for authentication on the community website over the wrt54gs mesh network... looking for help there too...
dan on :
How do I actually go about connecting to one of them? I'm fairly confused about this and I can't seem to find any resources anywhere on how to do this.
zurgutt on :
Correct kismet_drone.conf line on this hardware is:
source=wrt54g,eth1:prism0,wrt54g
IMPORTANT: apparently the prism0 interface has to be brought up manually before starting kismet. Use: "ifconfig prism0 up" . I have wasted a day not knowing this :P
Also the wl command tries to use eth1 and thus fails. Havent found out how to change that yet..
Matt on :
David on :