Kismet

Recent Commits

• Mike Kershaw / Dragorn(24 Oct 26)

  Merge branch 'rtl-ais-adsb'

• Mike Kershaw / Dragorn(24 Oct 26)

  adsb: report signal levels from the rtl-sdr sources aircraft now show signal strength, and the beast feed carries it

• Mike Kershaw / Dragorn(24 Oct 26)

  rtlaisadsb: add a combined ais and ads-b rtl-sdr source one rtl-sdr hops between ais and ads-b, sizing dwells from aircraft reception

• Mike Kershaw / Dragorn(24 Oct 26)

  Merge branch 'ais-bitorder'

• Mike Kershaw / Dragorn(24 Oct 26)

  ais: fix scrambled vessel positions and ids from the rtlais source

• Mike Kershaw / Dragorn(24 Oct 26)

  Merge branch 'datasource-fixes'

• Mike Kershaw / Dragorn(24 Oct 26)

  webui: fix locking and hopping sources whose channels contain a slash

• Mike Kershaw / Dragorn(24 Oct 26)

  datasources: log why channel and hopping changes fail

• Mike Kershaw / Dragorn(24 Oct 26)

  capture: keep websocket remote captures sending under load Busy remote sources no longer stall and get dropped for missing pings.

• Mike Kershaw / Dragorn(24 Oct 26)

  Merge branch 'tristan-fixes'

• Mike Kershaw / Dragorn(24 Oct 26)

  Merge branch 'gps-fixes'

• Tristan(24 Oct 26)

  capture: bound frame lengths from capture sources and the bladerf radio Malformed frames from capture tools or remote captures could slip past the length checks on 32-bit and be read past their buffers.

• Mike Kershaw / Dragorn(24 Oct 26)

  conf: correct how often the gps track is logged

• Mike Kershaw / Dragorn(24 Oct 26)

  gps: reconnect to gpsd after a failed connection attempt Kismet now keeps retrying gpsd every 10 seconds when it isn't running yet or refuses the connection.

• Mike Kershaw / Dragorn(23 Oct 26)

  Merge branch 'gps-satellites'

• Mike Kershaw / Dragorn(23 Oct 26)

  gps: report the satellites in view and log them to kismetdb Each GPS now lists its satellites (constellation, elevation, azimuth, signal, used in the fix) from NMEA, gpsd, u-blox and SiRF receivers, and kismetdb gets a GPSSATS snapshot every 30s (kis_log_gps_satellites_rate).

• Mike Kershaw / Dragorn(23 Oct 26)

  Merge branch 'ppi-gps'

• sighook(23 Oct 26)

  dlt_ppi: read PPI GPS within its field, and check every field's length Valid PPI GPS locations are decoded again, and malformed PPI headers can no longer make Kismet read GPS or radio data from outside the field.

• Mike Kershaw / Dragorn(23 Oct 26)

  Merge branch 'httpd-static-root'

• Mike Kershaw / Dragorn(23 Oct 26)

  httpd: answer requests for a directory with 404 instead of hanging

• sighook(23 Oct 26)

  httpd: don't serve files from sibling directories of the web root A request using .. could read files in a directory next to the web root whose name starts with the same name (CWE-22).

• Mike Kershaw / Dragorn(23 Oct 26)

  Merge branch 'nrf-ant'

• Mike Kershaw / Dragorn(23 Oct 26)

  capture_kismetdb: don't read past a packet or a missing column in a damaged log Replaying a kismetdb log whose packet length is larger than the stored packet, or with an empty packet or data column, no longer crashes the replay helper.

• Mike Kershaw / Dragorn(23 Oct 26)

  phy_nrf_mousejack, phy_ant: skip other phys' packets early and name private ANT devices plainly The nRF24 dissector no longer allocates for every packet of every phy. ANT devices on a private network are no longer named after an ANT+ profile, and the ANT phy registers after the existing phys.

• Ben(22 Oct 26)

  phy_ant: ANT and ANT+ devices (heart-rate straps, bike sensors, fitness equipment) from SDR pcaps ANT is the 2.4 GHz link of most fitness sensors: heart-rate straps, bike speed, cadence and power sensors, foot pods, fitness equipment, radars and lights, and the watches and head units that read them. On the air it is Nordic ShockBurst without the packet control field: GFSK at 1 Mbit/s on 1 MHz channels from 2400 to 2524 MHz (ANT+ is always 2457 MHz). A packet has: - the 2-octet network address, derived from the 8-octet network key (A6:C5 for ANT+); - the device number, least significant octet first; - the device type, with the pairing bit in bit 7; - the transmission type; - a length (10); - the 8-octet payload; - a CRC-16-CCITT. Kismet had no ANT support. SDR receivers can write ANT packets as pcap, such as w1700k's wifi-rx --ant-pcap (the layout and CRC are checked against packets captured from real ANT radios). That pcap uses user link type 148 with a 12-octet header (phy_ant.h): - 'A' 'N' 'T' and version 1; - the RF channel; - flags (CRC ok, repaired, ANT+); - the signal in dBm; - the address and payload lengths; - then the packet from the address to the CRC. The pcapfile source reads them. A packet whose CRC failed counts as an error and is not attributed; anything without the header is left alone. A device is keyed on its network address, device number, device type (without the pairing bit) and transmission type: the six octets a watch pairs on, as its MAC. It is named by its ANT+ device profile ("Heart rate monitor 49"), and its type reads "ANT+ Heart rate monitor", "ANT+ device" or "ANT device". It carries the channel, frequency and signal. Per device, ant.device (with a UI panel, icons and a row highlight): - the network and whether it is ANT+; - the device number, type and profile name, and the transmission type; - the channel, and whether the pairing bit was seen; - the last data page and payload; - from ANT+ data pages: - a heart-rate monitor's heart rate, and its manufacturer (page 2) and hardware, software and model (page 3); - the common pages newer profiles send: 80 (manufacturer ID, hardware revision, model), 81 (software version, serial number) and 82 (battery status). The manufacturer ID names the device's manufacturer when it is a common one (Garmin, Wahoo, Suunto, Polar, ...). A packet whose length octet does not name its payload and CRC (10 for the usual message) is left alone: another protocol's packet whose bits passed the 16-bit CRC by chance. Live, four such "devices" came from fixed-content transmitters on 2457 MHz (length octets 0x68, 0x92, 0x5B, 0x16) before the receiver learnt the same check. Tested with a private Kismet from this tree. The test pcap held an ANT+ heart-rate monitor (the packet captured from a real radio in rtl_433 issue 1990, then pages 0, 2 and 3), an ANT+ power meter (pages 80, 81, 82), a private network's device, a packet whose CRC failed and one with a foreign header. Kismet made three devices with their fields as sent, none from the last two, and the web UI showed them with their panel. Not yet tested with a live ANT+ device.

• Ben(21 Oct 26)

  kismet.ui.nrf_mousejack: a keyboard with a mouse over its corner for keyboard-and-mouse and unidentified devices The two Font Awesome glyphs stacked: the mouse at 0.62em over the keyboard's lower right corner, outlined in the row's highlight colour (--k-row-highlight, transparent without one) so the two stay apart where they overlap. Keyboards keep the keyboard, mice the mouse.

• Ben(21 Oct 26)

  kismet.ui.nrf_mousejack: a device icon (keyboard, or mouse) and a row highlight, as the other phys Font Awesome fa-keyboard for keyboards and unidentified nRF24 input devices, fa-computer-mouse for mice, so they take the device list's colour and size like the other phys' icons; and a row highlight, on by default as for the other radio phys, in a colour none of them uses (#f2d9f7).

• Ben(21 Oct 26)

  phy_nrf_mousejack: the dongle's buffer read right, SDR pcaps too; Logitech devices, receivers, an alert The research firmware's promiscuous mode (nrf-research-firmware src/radio.c) returns the 5-byte address, then the payload, the CRC checked and left out with the packet control field. The phy took the first 6 octets as the device's address (the address and the first payload octet: one device could become several) and fingerprinted the whole buffer with the MouseJack research's payload offsets, which never matched. Both are now read from the address and the payload. Enhanced ShockBurst packets also come from SDR receivers (w1700k's wifi-rx --esb-pcap), as pcap of user link type 147 with a 12-byte header that starts "ESB" and its version (phy_nrf_mousejack.h): the RF channel, rate, PID, signal, address and payload lengths, then the address, payload and CRC. The pcapfile source reads them; packets whose CRC failed count as errors and are not attributed; anything without the header is left alone. The channel, frequency and signal go to the device. Per device (nrfmousejack.device, with a UI panel): its kind (Logitech mouse, keyboard, keyboard and mouse, Microsoft device), the Logitech receiver it is paired with (the four address octets a receiver's devices share), address length, rate, channel, and counts of mouse reports, encrypted and unencrypted keystroke reports, keep-alives, acknowledgements (empty packets its receiver sends back with its address) and other packets. Logitech payloads are recognised by type and length (0xC2 mouse, 0xD3 encrypted keystrokes, 0xC1 unencrypted, 0x40 / 0x4F keep-alives) and their checksum. The encryption reads "AES (Logitech)", "None: unencrypted keystrokes" or "None (mouse reports)". A new alert, NRFPLAINTEXTKEYS, is raised once per keyboard that sends keystrokes unencrypted. Tested with a private Kismet: an SDR capture of a Logitech Unifying keyboard (465 encrypted keystroke reports, 344 keep-alives, 809 acknowledgements, receiver 4A:65:98:05, channel 32, 2 Mbit/s); synthetic SDR packets (a receiver's mouse and keyboard, unencrypted keystrokes raising the alert, a Microsoft device, a failed CRC and a foreign header making no device); and the same packets in the dongle's layout replayed from a kismetdb log under the NRFMOUSEJACK link type, giving the same devices (no channel or rate: the dongle does not report them). Not tested with a real dongle.

• Mike Kershaw / Dragorn(23 Oct 26)

  Merge branch 'signal-spread'

• Mike Kershaw / Dragorn(23 Oct 26)

  devicetracker: keep the weakest and strongest signal per minute, hour and day Devices now keep the range of signal they were heard at over the past minute, hour and day, for signal spread graphs.