Skip to main content

LAB-WIFI-202 — Kismet Passive Wireless Reconnaissance

LevelIntermediate
Duration75 minutes
EnvironmentRecorded Kismet dataset
EvidenceWireless asset and anomaly report

Purpose​

Use Kismet data to build a passive wireless inventory, distinguish access points from clients and identify configuration drift or rogue-network indicators without transmitting traffic.

Authorised scope​

Primary delivery uses the recorded northstar-lab.kismet fixture. Live capture is permitted only inside an instructor-controlled RF environment. Packet injection, association attempts and deauthentication are prohibited.

Learning objectives​

  • understand Kismet server, data source, device and log concepts;
  • identify SSIDs, BSSIDs, channels, encryption and client relationships;
  • detect duplicate, hidden, stale or unexpected wireless networks;
  • separate passive observations from verified ownership;
  • produce a wireless inventory and anomaly-handling plan.

Task 1 — Record dataset provenance​

Capture:

  • Kismet version;
  • dataset name and hash;
  • collection date and location label;
  • data-source type;
  • whether GPS data exists;
  • analyst and evidence-copy location.

Task 2 — Build the wireless inventory​

Using the Kismet web interface or exported data, list:

DeviceTypeSSIDBSSID/MACChannelEncryptionFirst/last seenConfidence

Use wireless.kismet in the synthetic evidence pack when the recorded database is unavailable.

Task 3 — Identify relationships​

Map:

  • access points broadcasting the same SSID;
  • clients associated with each access point;
  • probe requests for remembered networks;
  • devices changing channels or identities;
  • manufacturer/OUI information and its limitations.

Explain why a MAC vendor lookup is not proof of device ownership.

Task 4 — Investigate the unexpected SSID​

The dataset includes NORTHSTAR-GUEST-OLD. Determine:

  1. first and last seen times;
  2. BSSID and channel;
  3. encryption mode;
  4. associated clients;
  5. signal pattern or location evidence;
  6. whether the network could be stale configuration, a test device or a rogue access point;
  7. what additional evidence is needed before containment.

Checkpoint: Passive detection supports a hypothesis. Ownership and intent require inventory, controller, switch-port and physical-location evidence.

Task 5 — Design monitoring controls​

Recommend:

  • approved SSID/BSSID baseline;
  • alerting for new or changed networks;
  • retention and access control for wireless logs;
  • privacy-safe handling of client identifiers;
  • investigation workflow with network and facilities teams;
  • response actions that avoid disrupting legitimate networks.

Evidence requirements​

  • dataset provenance and hash;
  • wireless inventory;
  • relationship diagram;
  • unexpected-SSID investigation record;
  • monitoring and response plan;
  • statement confirming passive-only analysis.

Knowledge check​

1. What is the benefit of passive wireless monitoring?

It can inventory and observe wireless activity without associating with or actively probing devices.

2. Why can a hidden SSID still be discovered?

Management traffic and client behaviour can reveal network identifiers or relationships even when beaconing is limited.

3. Why protect client MAC data?

It can support device tracking and may be sensitive operational or personal data.

References​