kismet-2005_08_R1-24 (Wardrive using GPS)

12/Aug/2006 tested on SUSE10.1

Install Madwifi Driver

This installation will install madwifi driver with a patch aircrack.

Download driver and patch. First, download the latest patch, and then download the corresponding version of driver.

# get http://patches.aircrack-ng.org/madwifi-ng-r1679.patch
# get http://snapshots.madwifi.org/madwifi-ng/madwifi-ng-r1679-20060707.tar.gz

Install

# tar zxvf madwifi-ng-r1679-20060707.tar.gz
# cd madwifi-ng-r1679-20060707/
# patch -Np1 -i ../madwifi-ng-r1679.patch
# make
# make install
# mod_probe ath_pci

Create a new interface from wifi0. This might be required only for madwifi-ng driver. This creates ath1 monitor mode.

# wlanconfig ath1 create wlandev wifi0 wlanmode monitor

Install Kismet

# rpm -ihv kismet-2005_08_R1-24.i586.rpm

Open /etc/kismet.conf and enter a driver name which is listed in the README file, and interface, and name.
For madwifi card,

source=madwifing_g,ath1,ath_pci

Verity the USB Serial Driver

# desc | less
drivers/usb/serial/usb-serial.c: USB Serial support registered for Generic
usbcore: registered new driver usbserial_generic
drivers/usb/serial/usb-serial.c: USB Serial Driver core v2.0
drivers/usb/serial/usb-serial.c: USB Serial support registered for MCT U232
mct_u232 1-1:1.0: MCT U232 converter detected
usb 1-1: MCT U232 converter now attached to ttyUSB0
usbcore: registered new driver mct_u232
drivers/usb/serial/mct_u232.c: Magic Control Technology USB-RS232 converter driv
er z2.0

Now connect your GPS. There must be RX signals on the USB 232 interface. Verify the connection by following. You see something there.

If you are using GARMIN eTrex, I changed the format to "NMEA In/NMEA Out", 4800 bour, otherwise "GERMIN" format does not work.

# cat /dev/ttyUSB0 
,,M,,*66
$GPGSA,A,1,,,,,,,,,,,,,,,*1E
$GPGSV,3,2,10,19,18,045,00,24,09,158,00,26,31,300,00,27,45,142,00*7C
$GPGLL,,,,,,V,N*64

Start gpsd

# gpsd -p /dev/ttyUSB0 -s 4800

Start kismet

# kismet

You may create a script to make you easy to run as /root/bin/mykismet

# Start gpsd
gpsd -p /dev/ttyUSB0 -s 4800

# Create ath1 as a monitor mode interface (madwifi)
wlanconfig ath1 create wlandev wifi0 wlanmode monitor

# Start Kismet
kismet

# kill gpsd process
killall gpsd

Generate map

Kismet generates files where you executed. Using these files, gpsmap command can generate various maps.

I created this script to generate various maps automatically. Once you see maps, you might need only a range option. Create as /root/bin/mygpsmap,

#!/bin/bash
#
# Usage: mygpsmap 
# Run where *.gps are
# create result directory for maps
#

# Map file name prefix
FILE="tokyo-`date +%Y%m%d`"

# Own equipment to exclude
MAC_OUR="00:03:2F:23:A2:F4,00:0E:35:7B:8D:39"

# Other equipment to exclude
MAC_KNOWN="00:A0:B0:40:5C:84,00:04:23:52:80:41,00:30:13:FA:58:06"

# gpsman command with nice
GPSMAP="nice gpsmap"

# gps files (kismet output files)
FILEGPS=`ls *.gps`

## Options: thread(z)=10, legend(k), Network Color(n)=1, Draw Power(p)
OPT="-z 10 -k -n 1 -p"

# Labels=ssid, manuf
OPT="$OPT -l ssid,manuf"

# Scale to change, if need, i.e., Scale(s)=4000, Mapsize(d)=10000,10000
# OPT="$OPT -s 4000 -d 10000,10000" 

# Result map output directory
RESULT="result"

# Result directory
if [ ! -d $RESULT ]; then
	mkdir $RESULT
fi

# Range(r)
$GPSMAP $OPT -f $MAC_KNOWN,$MAC_OUR \
	-o $RESULT/$FILE-range.png \
	-r $FILEGPS

# Range(r), Track(t)
$GPSMAP $OPT -f $MAC_KNOWN,$MAC_OUR \
	-o $RESULT/$FILE-range-track.png \
	-r -t $FILEGPS

# Hull(u), Track(t)
$GPSMAP $OPT -f $MAC_KNOWN,$MAC_OUR \
	-o $RESULT/$FILE-hull-track.png \
	-u -t $FILEGPS

# Scatter(a), Track(t)
$GPSMAP $OPT -f $MAC_KNOWN,$MAC_OUR \
	-o $RESULT/$FILE-scatter-track.png \
	-a -t $FILEGPS

Wardriving Steps

This is a steps I manage wardriving!

Start Linux box with USB Serial Interface. No GPS (eTrex) connected! (Important)

Start GPS (eTrex). Make sure the interface is "NMEA IN/NMEA Out"

Now connect the GPS (eTrex) to the USB Serial Interface

Create a directory for today's drive, and execute kismet,

# mkdir tokyo-20060813
# cd tokyo-20060813
# mykismet

After the drive, type this in the directory to generate maps

# mygpsmap

This script create a result directory for maps

Back