Friday, January 20, 2012

Kismet on Android

So it's super unstable, but Kismet can run on android now:

Requires Android 4.x for USB host, does NOT require root.

Packets are captured with userspace rtl8187 driver written in java, sent to a kismet-drone work-alike also written in java, which allows an unmodified kismet_server to read them.

Output is kluged into a textview to at least be able to see what's going on.

Currently the code doesn't channel hop, though that should be possible without too much trouble.  The process.exec thread doesn't kill off kismet_server when the background service ends, there's usb init timing problems, etc, but it's a major step forwards.

Ultimately, kismet_server will be hidden completely and the Java UI will tap the kismet client protocol for a native display.

Still... progress!  Code and test apk to come in the future.


  1. Also re: a semi-common question, "what about the built-in nic"...

    The goal was to get Kismet running on unmodified phones, so that wasn't the focus.

    If you have a rooted phone however, and can get a mac80211 driver loaded, kismet ought to run just fine - infact it should even auto-detect the mac80211 driver and go.

    Right now the port isn't linked with the native capture sources or netlink libs, but those are probably all thats needed to have it work with the built-in.

  2. This comment has been removed by the author.

  3. can u post the steps to do it?

  4. I would be interested in a step by step guide to doing it on a rooted android device. I have a Toshiba thrive tablet and it has a REAL USB port. My atheros USB wireless card comes up in the system just fine when i look at dmesg.

  5. Is your source code for this available anywhere, even in an unpolished form?

  6. Did you actually get kismet to run on a rooted phone or have you been concentrating on kisbee exclusively? I'd love to have a kismet (or similar capability) for use on a rooted phone.

  7. I am sorry but I am not aware of the WiFi USB device that you use for this experiment. But if you are using rtl8187 driver as you mentioned above, then I wonder if I can repeat the experiment using my NETGEAR WG111v2 since it has the same chip by RealTek whose driver is rtl8187 ?

  8. I am interested in getting packet injection working. I want to work on this. Can you give the pointers? What functions should I look at? Do you have HW spec of the 8187 chipset to better understand it?

  9. Is there an APK available? What is the Link to the APK?

  10. Fins: Should work w/ any 8187, see 'android pcap' in the market

    nag: Yeah, inject could be made to work, see 'android pcap' which is in the market, plus the source is published

    Rattlesnake: no, I haven't gotten it working to a release satisfaction and USB host is amaingly flaky