Kismet Server/Drone

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 22:08, 9 July 2005 (edit)
62.255.64.6 (Talk)
(What is Kismet)
← Previous diff
Revision as of 22:09, 9 July 2005 (edit) (undo)
62.255.64.6 (Talk)
(What is Kismet)
Next diff →
Line 13: Line 13:
Since Kismet is a Linux project, it can run as either the full server, or just a drone server on the WRT54G router. You are then free to run a Kismet client on your desktop computer view the output. Since Kismet is a Linux project, it can run as either the full server, or just a drone server on the WRT54G router. You are then free to run a Kismet client on your desktop computer view the output.
-''See also installing [[kismet on linux]] for a description of how to set up a wrt54g as a drone using a linux desktop/laptop machine to act as server and client.''+''See also installing [[kismet on linux]] for a description of how to set up a wrt54g as a drone using a linux desktop/laptop machine to act as server and client.'' [[wrt54g kismet with linux server]]
=Server or Drone= =Server or Drone=

Revision as of 22:09, 9 July 2005

You are here: Main Page/DD-WRT Docu (EN)/Kismet Server/Drone

Contents

Introduction

Anyone familiar with Network Stumbler will definitely appreciate running Kismet Server or Kismet Drone on their WRT54G, since this router has some of the best radios around, along with nice sturdy RP-TNC connectors to hook up even better antennas to without worry about damaging your wireless card or radio pigtails (I've gone through a number of PCI cards with RP-SMA connectors that keep breaking appart).

This Wiki assumes you already have a current build of DD-WRT installed on your router.

What is Kismet

Kismet is a layer 2 wireless network detector, sniffer, and intrusion detection kit.

Kismet is an OSS project for Linux. Find out more information about it at the Official Kismet Wireless site.

Since Kismet is a Linux project, it can run as either the full server, or just a drone server on the WRT54G router. You are then free to run a Kismet client on your desktop computer view the output.

See also installing kismet on linux for a description of how to set up a wrt54g as a drone using a linux desktop/laptop machine to act as server and client. wrt54g kismet with linux server

Server or Drone

Drone

The Kismet project has developed the capability of running Drones: devices with wireless cards that mearly send their data back to a Kismet server. If you run the Kismet Drone on your DD-WRT box, you'll need to run the client and the server elsewhere. Both can be on your desktop computer, or you could have a machine somewhere else running just the server. Running a Kismet drone on your WRT and the Client/Server on a desktop computer(s) seems to be the most common installation.

While drones require a little more work to install, they provide 3 benifits over running full servers on the WRT.
1) It is easier to save captured packets to user later, such as for WEP decryption.
2) Drone installations are smaller, requiring less space on the WRT
3) Drone installations probably require less processing power allowing you to run more additional programs on your WRT.

Install Drone on WRT54G/S

Server

Since the kismet server is capable of running on top of DD-WRT one is able to simplify the installation by only running a client on their desktop machine. I'm not exactly sure what the advantages are, except that this seemed to be easier to install. Since the actual server is running on the DD-WRT, any packets captured will be saved on the WRT, meaning you will have to copy them to your desktop if you plan to interpret them (such as for WEP decryption.) This is why running the drone only on the WRT, and running the server+client on the desktop might be a better idea (captured packets would be saved to the desktop machine).
One of the advantages of an server on your desktop machine is: you can have multiple drone connected to that server and it will generate only one log file Install Server on WRT54G/S

Installing & Configuring on the WRT54G

Drone

IMPORTANT NOTE: My installation guide describes how to set up BOTH the server and the drone on the WRT - which doesn`t make much sense: if you want to capture packages the server needs to run on your linux box (windows might also work but you would need to compile the server within cygwin - I don`t think this works: the last links to another how-to on this site says it won`t compile with the pcap option within cygwin).

Question: What is the point of installing the drone on the WRT? if you're going to put the server there too? Why not just do the server on the WRT? I thought the whole point in putting the drone on the WRT is so you can put the server on your desktop machine instead of on the WRT??

Answer: This is exactly the problem - at the moment it is REALLY pretty much useless.
Normally you would install only the server on the WRT to get a fast result (as you said above). The disadvantage is that you can`t capture packets easily - you may do it with the SD Card-Mod, by mounting an SMB or NFS share or by simply copying the files from the WRT but this quite complicated (especially for larger dumps). Having the drone on the WRT would mean that you could run the server on your desktop to log the packets - as I have only got windows I can`t run the server on my box (I didn`t see that I couldn`t log packets this way - it was a little late when I did this...). As a defense I have to say that the other that is linked on this page also uses the drone and the server on the WRT. If you have Linux this how-to might be useful on how to set up an drone - on linux you can dump packets.
I have also found out that because of some weird problem the server alone supports channel hopping - the drone from rops site doesn`t do this (it says that the source (prism0) isn`t able to do it - but the server does it ???). Simply try it - it might work for you.

Assumptions

 --Your router has SSH configured and you can send files via SSH to and from your desktop
 --You have a text editor capable of Unix line delimiters. TextPad and win32pad are both acceptable (and free).
Failure to use one of these when editing text files will prevent your installation from working --You have telnet or SSH enabled on your router. --You have jffs enabled or do mind redoing this whenever the router reboots --I will assume you are installing to the jffs partition. If you are not, replace jffs with tmp or some other folder

Preparation

--Dowload this file to your computer:
  --Kismet-Drone-Package
--Download this one too if you are going to run the server 
  --Kismet-Server-Package
--Now rename them from *.ipk to *.tar.gz and extract them
--When everything is extracted you may delete the control folders since we don`t need them. 
  --The files we need are the following - copy all of them to a folder named "kismet":
    *insert_your_extraction_path_here*/data/usr/bin/kismet_drone
    *insert_your_extraction_path_here*/data/etc/kismet_drone.conf
  --These will be needed for the server:
    *insert_your_extraction_path_here*/data/usr/bin/kismet_server
    *insert_your_extraction_path_here*/data/etc/kismet.conf
--Edit the kismet_drone.conf file 
  --Find the line "source=wrt54g..."
  --Change it to "source=wrt54g,prism0,drone"

Copy the Files

 Load up WinSCP or some other SCP client to copy the files over
 --Browse to /jfss 
 --Copy the folder "kismet" from your computer to the /jfss folder on your wrt54g

Installation

 Telnet/SSH to your router and finish the configuration.
 Disable AP mode and enable passive mode (alternatively, you can choose client mode from the web interface)
 --enter the command "wl ap 0"
 --enter the command "wl passive 1"
 Make the binaries executable. 
 --enter the command "chmod 755 /jffs/kismet/kismet_drone"
 And for the server run:
 --enter the command "chmod 755 /jffs/kismet/kismet_server"
   You may also do this by using WinSCP:
 -- Open the properties for the files (press "F9") and check the "x" in the line "owner"

Run Kismet

  A) You can launch the server on startup (let me know if you know how to do this).
  B) You can telnet into the router and launch it manually.
  C) You can launch the server manually from the web interface

 Method A: You can launch the server on startup
 In principle you would simply need to install the Startup Scripts out of the data directory that came within the *.ipks 
- I don`t know how to do this. I guess you would also have to edit them - they are using different paths than we used
for the installation of the binaries and configuration files. Continue to Desktop Configuration
 Method B: You can telnet into the router and launch it manually.
 Disadvantage: Server will stop if you close the telnet/putty window - the drone will keep running
 --Telnet/SSH into the Router
   --enter the command /jffs/kismet/kismet_drone -f /jffs/kismet/kismet_drone.conf
   --enter the command /jffs/kismet/kismet_server -f /jffs/kismet/kismet.conf
Continue to Desktop Configuration
 Method C: Launch the server manually fromt the web interface - when you launched the drone via telnet/SSH it will run 
in the background even if you close the connection
Disadvantage: Server doesn't always start correctly, forcing a reboot to fix --Log into your routers web interface. --Click on the Administration Tab --Click on the Diagnostics subtab --Click the run button --enter the command /jffs/kismet/kismet_drone -f /jffs/kismet/kismet_drone.conf and click cmd --enter the command /jffs/kismet/kismet_server -f /jffs/kismet/kismet.conf and click cmd Continue to Desktop Configuration

see also installing kismet on linux

Server

Assumptions

 --Your router has SSH configured and you can send files via SSH to and from your desktop
 --You have a text editor capable of Unix line delimiters. TextPad and win32pad are both acceptable (and free).
Failure to use one of these when editing text files will prevent your installation from working --You have telnet enabled on your router. --You have jffs enabled or do mind redoing this whenever the router reboots --I will assume you are installing to the jffs partition. If you are not, replace jffs with tmp or some other folder

Preperation

 The guy at Musatcha.com has put together a great binary to make installation simplier. Download it.
 --Extract the two files to somewhere on your computer.
 --Edit the kismet.conf file 
  -- Find the line "source=wrt54g..."
  -- Change it to "source=wrt54g,prism0,wrt54g"
  -- Find the line "allowedhosts=...."
  -- Change it to "allowedhosts=192.168.1.0/24" (Network-Hardrware-IPs: 192.168.1.1 -> 192.168.1.254 Subnet-Mask: 255.255.255.0)
    -- If you are not using 192.168.1.x for your network, substitute your network setup.

Copy the Files

 Load up WinSCP or some other SCP client to copy the files over
 --Browse to /jfss 
 --Make a folder called "kismet_server"
 --Copy kismet_server and kismet.conf from your computer to the /jfss/kismet_server folder on your wrt54g

Installation

 Telnet to your router and finish the configuration.
 -- telnet 192.168.1.1
   --Log in. username: root password : [Your-Routers-Password]
 Disable AP mode and enable passive mode (alternatively, you can choose client mode from the web interface)
 -- enter the command "wl ap 0"
 -- enter the command "wl passive 1"
 Make the server binary executabe
 -- enter the command "chmod 755 /jffs/kismet_server/kismet_server"

Run the Server

  A) You can launch the server on startup (let me know if you know how to do this).
  B) You can telnet into the router and launch it manually.
  C) You can launch the server manually from the web interface
  D) You can have a client, such as Musatcha.com, automatically telnet in and launch the server.

 Method A: You can launch the server on startup
 I'm not sure how to do this. I'm not a linux guy.
Continue to Desktop Configuration
 Method B: You can telnet into the router and launch it manually.
 Disadvantage: Server will stop if you close the telnet window
 --Telnet into the Router
 --enter the command /jffs/kismet_server/kismet_server -n -f /jffs/kismet_server/kismet.conf
Continue to Desktop Configuration
 Method C: Launch the server manually fromt the web interface
 Disadvantage: Server doesn't always start correctly, forcing a reboot to fix 
 --Log into your routers web interface.
 --Click on the Administration Tab
 --Click on the Diagnostics subtab
 --Click the run button
 --Enter the command in the command box and click the "cmd" button.
Continue to Desktop Configuration
 Method D: You can have a client, such as Musatcha.com, automatically telnet in and launch the server.
 Disadvantage: Currently can't send Usernames and Passwords, so you have to launch using another method.
 --Visit Musatcha's howto and view step 5.
Continue to Desktop Configuration

Installing & Configuring on the Desktop

When installed on WRT as drone

This is simple: use method B or C as if you had set up only the server (maybe A - the whole WiFi mapping software didn`t work for me so I didn`t test it)

When installed on WRT as server

Choose a client:
If you have a linux box, you can run Kismet client right off your desktop.
If you have a Windows box, you have to do something else.
  A) Use Musatcha.com's WiFi mapping software.
  B) Run Compile Kismet to run on Cygwin
  C) Run the precompiled Kismet for windows on Cygwin.

 Method A: Musatcha.com's WiFi Mapping Software
 -- Read Step 5 from his guide
 Method B: Compile Kismet to run on Cygwin
 --Install Cygwin.
   -- Make sure to install the developer tools. You'll need gcc, make, subversion, etc
 -- svn the source into your cygwin
 -- make, etc. See the guide in the external links. I couldn't get this to work.
 Method C: Precompiled Kismet for Windows on Cygwin
 --Install Cygwin, a *nix environment for Windows. 
   --Minimal install is fine.
 --Download an unzip the precompiled client to a folder
 --Edit kismet_ui.conf to reflect your correct WRT LAN ip address
   --find "host=192.168.1.1:2501"
   --change it if your router is not 192.168.1.1
 --Run kismet_client.exe WHILE your server is running on the router. You may have to 
launch a cygwin command prompt first. Cygwin behaves kinda weird sometimes. --The client is entirely keyboard driven. Press the 'h' key for help. You'll probably want to turn off auto sort right
away so you can view extended information about individual networks. Press the 's' key to do this.

External Links

These are the references I used when creating this wiki
Kismet on the WAP54G
WRT54G with OpenWRT + kismet-drone + kismet-server and kismet_client for windows (XP) running on cygwin
Kismet on Windows How-To guide V0.1


You are here: Main Page/DD-WRT Docu (EN)/Kismet Server/Drone