Kismet and CatSniffer: Initial Setup and Packet Capturing

Kismet is a tool for wireless network discovery and intrusion detection. While many tools focus on active scanning (sending out probes to see who answers), Kismet operates on a philosophy of passive monitoring. It acts as a silent observer, "listening" to the radio frequency (RF) environment without transmitting a single bit. This makes it a powerful tool for mapping networks without disturbing the ecosystem or alerting the devices within it.

Beyond its stealth, Kismet's true strength is its framework. It isn't just a Wi-Fi tool; it is a modular engine designed to aggregate data from multiple sources simultaneously. Through its web-based dashboard, Kismet can visualize device relationships, manufacturer signatures, and signal metrics in real-time. When we point this engine at the IEEE 802.15.4 standard, the physical layer for Zigbee, we gain the ability to peel back the curtain on smart light bulbs, sensors, and mesh gateways that would otherwise remain hidden.

CatSniffer as the Gateway

If Kismet provides the interface and the intelligence, CatSniffer provides the physical capability to reach into the 2.4GHz and Sub-GHz spectrums. CatSniffer is a versatile, open-source tool built for IoT protocol analysis. While it is capable of handling LoRa and Bluetooth Low Energy (BLE), its utility as a Zigbee sniffer is particularly noteworthy.

For this tutorial, we focus on the board's ability to act as a dedicated sniffer node. By leveraging the onboard Texas Instruments CC1352, the CatSniffer can be tuned to specific Zigbee channels. It captures the raw 802.15.4 packets flying through the air and pipes them over its USB-C interface. In this configuration, the CatSniffer serves as the data source for Kismet, transforming raw radio waves into a structured data stream that the Kismet framework can decode and display. This integration allows us to bridge the gap between low-level hardware signals and high-level network analysis.

The primary mission of this guide is to move beyond theoretical security and into practical observation. As Zigbee devices become ubiquitous, they create a dense, invisible mesh of communication. Standard security audits often overlook this layer because of the specialized hardware required to see it. By combining Kismet and CatSniffer, we are building a platform capable of mapping these networks, identifying unauthorized devices, and capturing traffic to verify that sensitive data is properly encrypted.

Preparing the Environment: Installing Kismet

The first step in our journey is setting up the Kismet. Kismet is available for Linux, macOS, and Windows (through a Linux virtual machine). This tutorial is based on a Linux Ubuntu installation, but you can always find the instructions in the official Kismet documentation.

We recommend checking that your system is up to date before continuing.

sudo apt update && sudo apt upgrade

The installation may take a few minutes, depending on the internet speed and PC resources, so be patient during the installation.

Preparing the Hardware: Installing the Sniffer firmware

The next step is preparing the CatSniffer to be able to work with Kismet, for this is required to be flashed with a specific firmware. Thanks to Catnip, this is easy to do.

1. Check if Catnip is up to date or install the tool. You can directly download it from the official repository: CatSniffer Tools.

2. Verify that the Catnip tool can detect the CatSniffer by sending the command:

catnip devices

3. Install the ti_sniffer firmware in your CatSniffer using Catnip:

catnip flash ti_sniffer

To confirm that the firmware was flashed, you will see something like this:

ℹ Flashing firmware: ti_sniffer to device: CatSniffer #1
  Resolved 'ti_sniffer' to ti_sniffer -> sniffer_fw_Catsniffer_v3.x.hex
ℹ Opening bridge port COM50 at baud: 500000
ℹ Sending boot command via shell port: COM49
ℹ Boot command sent successfully
ℹ Chip ID: 0xF000 (CatSniffer CC1352 (Bootloader Mode))
ℹ Chip details:
  Package: CC1350 PG2.0 - 704 KB Flash - 20KB SRAM - CCFG.BL_CONFIG at 0x000AFFD8
  Primary IEEE Address: 00:12:4B:00:29:B6:82:3C
ℹ Performing mass erase
✓ Erase done
✓ Write done
ℹ Verifying by comparing CRC32 calculations.
✓ Verified match: 0x52c24bf8
ℹ Sending exit command via shell port
ℹ Exit command sent successfully
ℹ Waiting for device to initialize after reset...
ℹ Metadata update attempt 1/5...
    ├─ Testing shell responsiveness...
    ├─ Shell responsive, updating metadata...
    └─ Metadata updated successfully
✓ Firmware metadata updated successfully
ℹ Waiting for device to restart...
✓ Device restart complete. Firmware is ready to use!
ℹ Sending identification command to CatSniffer #1...
ℹ Device response: identifyIdentifying board...
✓ Identification command sent to device #1!

After this, the CatSniffer is ready to use with Kismet.

Kismet and CatSniffer

Kismet does not rely on CatSniffer, so if you run Kismet, you will encounter that CatSniffer is not detected. This is expected, and that is why we are here.

1. Connect the CatSniffer running the Sniffer firmware.

2. In a new terminal, run the following command:

kismet -c "catsniffer_zigbee:device=/dev/ttyACMXX,name=Name_You_Prefer,channel_hop=false/true,channel=XX"

You must select the correct serial port for the device, choose a name for the device, and select the channel. For this use case, we set the name to "Peqe", activate the channel hop, this make the datasource (our CatSniffer) move through the ZigBee used channels, and we set channel 25 at the start point for Kismet to start reading. We also set channel 25, as we know there is an active network on this channel.

kismet -c "catsniffer_zigbee:device=/dev/ttyACM0,name=Peqe,channel_hop=true,channel=25"

3. After running the command, Kismet will set up everything in the background. Once it is ready in the console terminal, you will see at the top an announcement, click on the IP address, or open it in a web browser.

4. The first time running Kismet, you will need to set up a user and password; save these for future use.

5. Configure the Data Sources setting under the "hamburger" menu > Data Sources. This menu is useful to configure which channels the CatSniffer can sniff on, the channel hopping channels, and the status of the device. This is really useful when we already know the network we are monitoring.

6. Kismet will start to display the captured packets by the datasource, AKA CatSniffer.

Now that everything is set up, we can start analyzing the data obtained and displayed in Kismet. If we click on one of the sniffed packets, Kismet will prompt a more detailed view of the packets sniffed from this ID. Let's do a breakout of these views.

Now that we have understood all these views and data, you will wonder, "Now what?", and that is where the possibilities start. Here are some of them.

What can I do with CatSniffer and Kismet?

1.Device identification in a physical space:

By observing the "Seen By" and "Signal" graphs, you can physically locate devices in a building. If a specific sensor has a weak signal, you can use the CatSniffer to identify which Zigbee Router it is hopping through, helping you diagnose mesh connectivity issues that standard smart home apps won't show you. Adding to this, if the device info view gives us information like the manufacturer, this will make the work easier.

2. Exporting the data to Wireshark

Deep analysis often requires the power of Wireshark. Kismet saves all captured traffic into a .kismet (SQLite) database. You can convert this into a standard PCAP-NG file that Wireshark understands by using the kismetdb_to_pcap integrated tool. To convert the files, you can use the following command structure:

kismetdb_to_pcap --in your_log_file.kismet --out zigbee_capture.pcapng

Opening the file in Wireshark allows you to inspect the actual Zigbee Cluster Library (ZCL) commands. If you have the Zigbee network's trust center link key, you can even decrypt the traffic to see exactly what data, such as "Unlock" commands or "Motion Detected" alerts, is being sent across your home.

3. Wardriving and Geospatial Mapping

One of the features of Kismet is its ability to integrate with GPS. By connecting a simple USB GPS module to your laptop, Kismet will tag every captured Zigbee packet with precise latitude and longitude coordinates.

This transforms your CatSniffer into a Zigbee Wardriving rig. As you move through an environment, Kismet builds a geographic database of IoT presence. You can later export this data to a KML file and visualize your local IoT landscape on Google Earth, as we did before with Minino. This is particularly useful for security researchers performing urban audits to see how many "smart cities" or industrial sensors are exposed to the streets.

4. Setting Up Wireless Intrusion Detection (WIDS)

You can configure Kismet to act as a security guard for your Zigbee network. By using the Alerts system, you can set up notifications for specific events, such as:

• New Device Discovery: Receive an alert the moment an unknown Zigbee device attempts to join the airwaves.
• Signal Anomalies: Detect potential jamming or interference by monitoring "noise" floors.
• Device Lost: Get notified if a critical security sensor (like a window contact) stops communicating with the mesh.

You can find more about Alerts in the official docummentation.

Now you have bridged the gap between expensive, proprietary industrial sniffers and "accessible" open-source hardware. The CatSniffer does not just "show" you packets; it gives you the keys to understand the invisible infrastructure surrounding us. Whether you are a developer debugging a new sensor or a researcher auditing a building's security, this Kismet-powered setup provides the visibility needed to move from guesswork to ground truth.