Introduction to Kismet utility for discovering wireless networks

Kismet detects the presence of wireless networks, including those with hidden SSIDs. It can discover and report the IP range used for a particular wireless network, as well as its signal and noise levels. Kismet can also capture or "sniff" all network management data packets for an available wireless network. You can use Kismet to locate available wireless networks, troubleshoot wireless networks, optimize signal strength for access points and clients, and detect network intrusions.

While NetStumbler and Kismet run on different platforms, many people have access to both, which often leads to comparisons between the two.

Passive vs. Active Sniffers

Kismet is a passive sniffer. Unlike NetStumbler, which broadcasts a request for access points responding to the SSID name "ANY," Kismet does not send any packets at all. Instead, Kismet works by putting the wireless client adapter into RF monitor mode. While in so-called "rfmon" mode, the wireless client is not (and cannot be) associated with any access point. Instead, it listens to all wireless traffic. Consequently, your wireless card cannot maintain a functional network connection while under Kismet control.

Users often report that Kismet finds more APs than NetStumbler. This is because NetStumbler only knows about access points that respond to its "ANY" SSID probe request. Some network administrators configure their APs not to broadcast, or to "hide" their SSID. These do not respond to NetStumbler's probe. Because the AP blanks out its SSID, Kismet will detect its presence, but without a network name. However, when a legitimate client associates with that AP, its real SSID is included in the initial handshake. Because Kismet sees all network management traffic, it will pick up these packets and discover the SSID which was supposedly "hidden.

Continue at source: Introduction to Kismet