mirror of
git://projects.qi-hardware.com/openwrt-xburst.git
synced 2024-12-11 14:50:18 +02:00
0672b5981e
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@1548 3c298f89-4303-0410-b956-a3cf2f4a3e73
282 lines
11 KiB
Plaintext
282 lines
11 KiB
Plaintext
# Kismet config file
|
|
# Most of the "static" configs have been moved to here -- the command line
|
|
# config was getting way too crowded and cryptic. We want functionality,
|
|
# not continually reading --help!
|
|
|
|
# Version of Kismet config
|
|
version=2005.01.R1
|
|
|
|
# Name of server (Purely for organiational purposes)
|
|
servername=Kismet
|
|
|
|
# User to setid to (should be your normal user)
|
|
suiduser=nobody
|
|
|
|
# Sources are defined as:
|
|
# source=cardtype,interface,name[,initialchannel]
|
|
# Card types and required drivers are listed in the README.
|
|
# The initial channel is optional, if hopping is not enabled it can be used
|
|
# to set the channel the interface listens on.
|
|
# YOU MUST CHANGE THIS TO BE THE SOURCE YOU WANT TO USE
|
|
source=wrt54g,eth1,wireless
|
|
# For v1 hardware uncomment this:
|
|
# source=wrt54g,eth2,wireless
|
|
|
|
# Comma-separated list of sources to enable. This is only needed if you defined
|
|
# multiple sources and only want to enable some of them. By default, all defined
|
|
# sources are enabled.
|
|
# For example:
|
|
# enablesources=prismsource,ciscosource
|
|
|
|
# Do we channelhop?
|
|
channelhop=true
|
|
|
|
# How many channels per second do we hop? (1-10)
|
|
channelvelocity=5
|
|
|
|
# By setting the dwell time for channel hopping we override the channelvelocity
|
|
# setting above and dwell on each channel for the given number of seconds.
|
|
#channeldwell=10
|
|
|
|
# Do we split channels between cards on the same spectrum? This means if
|
|
# multiple 802.11b capture sources are defined, they will be offset to cover
|
|
# the most possible spectrum at a given time. This also controls splitting
|
|
# fine-tuned sourcechannels lines which cover multiple interfaces (see below)
|
|
channelsplit=true
|
|
|
|
# Basic channel hopping control:
|
|
# These define the channels the cards hop through for various frequency ranges
|
|
# supported by Kismet. More finegrain control is available via the
|
|
# "sourcechannels" configuration option.
|
|
#
|
|
# Don't change the IEEE80211<x> identifiers or channel hopping won't work.
|
|
|
|
# Users outside the US might want to use this list:
|
|
# defaultchannels=IEEE80211b:1,7,13,2,8,3,14,9,4,10,5,11,6,12
|
|
defaultchannels=IEEE80211b:1,6,11,2,7,3,8,4,9,5,10
|
|
|
|
# 802.11g uses the same channels as 802.11b...
|
|
defaultchannels=IEEE80211g:1,6,11,2,7,3,8,4,9,5,10
|
|
|
|
# 802.11a channels are non-overlapping so sequential is fine. You may want to
|
|
# adjust the list depending on the channels your card actually supports.
|
|
# defaultchannels=IEEE80211a:36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,184,188,192,196,200,204,208,212,216
|
|
defaultchannels=IEEE80211a:36,40,44,48,52,56,60,64
|
|
|
|
# Combo cards like Atheros use both 'a' and 'b/g' channels. Of course, you
|
|
# can also explicitly override a given source. You can use the script
|
|
# extras/listchan.pl to extract all the channels your card supports.
|
|
defaultchannels=IEEE80211ab:1,6,11,2,7,3,8,4,9,5,10,36,40,44,48,52,56,60,64
|
|
|
|
# Fine-tuning channel hopping control:
|
|
# The sourcechannels option can be used to set the channel hopping for
|
|
# specific interfaces, and to control what interfaces share a list of
|
|
# channels for split hopping. This can also be used to easily lock
|
|
# one card on a single channel while hopping with other cards.
|
|
# Any card without a sourcechannel definition will use the standard hopping
|
|
# list.
|
|
# sourcechannels=sourcename[,sourcename]:ch1,ch2,ch3,...chN
|
|
|
|
# ie, for us channels on the source 'prism2source' (same as normal channel
|
|
# hopping behavior):
|
|
# sourcechannels=prism2source:1,6,11,2,7,3,8,4,9,5,10
|
|
|
|
# Given two capture sources, "prism2a" and "prism2b", we want prism2a to stay
|
|
# on channel 6 and prism2b to hop normally. By not setting a sourcechannels
|
|
# line for prism2b, it will use the standard hopping.
|
|
# sourcechannels=prism2a:6
|
|
|
|
# To assign the same custom hop channel to multiple sources, or to split the
|
|
# same custom hop channel over two sources (if splitchannels is true), list
|
|
# them all on the same sourcechannels line:
|
|
# sourcechannels=prism2a,prism2b,prism2c:1,6,11
|
|
|
|
# Port to serve GUI data
|
|
tcpport=2501
|
|
# People allowed to connect, comma seperated IP addresses or network/mask
|
|
# blocks. Netmasks can be expressed as dotted quad (/255.255.255.0) or as
|
|
# numbers (/24)
|
|
allowedhosts=127.0.0.1
|
|
# Maximum number of concurrent GUI's
|
|
maxclients=5
|
|
|
|
# Do we have a GPS?
|
|
gps=false
|
|
# Host:port that GPSD is running on. This can be localhost OR remote!
|
|
gpshost=localhost:2947
|
|
# Do we lock the mode? This overrides coordinates of lock "0", which will
|
|
# generate some bad information until you get a GPS lock, but it will
|
|
# fix problems with GPS units with broken NMEA that report lock 0
|
|
gpsmodelock=false
|
|
|
|
# Packet filtering options:
|
|
# filter_tracker - Packets filtered from the tracker are not processed or
|
|
# recorded in any way.
|
|
# filter_dump - Packets filtered at the dump level are tracked, displayed,
|
|
# and written to the csv/xml/network/etc files, but not
|
|
# recorded in the packet dump
|
|
# filter_export - Controls what packets influence the exported CSV, network,
|
|
# xml, gps, etc files.
|
|
# All filtering options take arguments containing the type of address and
|
|
# addresses to be filtered. Valid address types are 'ANY', 'BSSID',
|
|
# 'SOURCE', and 'DEST'. Filtering can be inverted by the use of '!' before
|
|
# the address. For example,
|
|
# filter_tracker=ANY(!00:00:DE:AD:BE:EF)
|
|
# has the same effect as the previous mac_filter config file option.
|
|
# filter_tracker=...
|
|
# filter_dump=...
|
|
# filter_export=...
|
|
|
|
# Alerts to be reported and the throttling rates.
|
|
# alert=name,throttle/unit,burst
|
|
# The throttle/unit describes the number of alerts of this type that are
|
|
# sent per time unit. Valid time units are second, minute, hour, and day.
|
|
# Burst describes the number of alerts sent before throttling takes place.
|
|
# For example:
|
|
# alert=FOO,10/min,5
|
|
# Would allow 5 alerts through before throttling is enabled, and will then
|
|
# limit the number of alerts to 10 per minute.
|
|
# A throttle rate of 0 disables throttling of the alert.
|
|
# See the README for a list of alert types.
|
|
alert=NETSTUMBLER,5/min,2
|
|
alert=WELLENREITER,5/min,2
|
|
alert=LUCENTTEST,5/min,2
|
|
alert=DEAUTHFLOOD,5/min,4
|
|
alert=BCASTDISCON,5/min,4
|
|
alert=CHANCHANGE,5/min,4
|
|
alert=AIRJACKSSID,5/min,2
|
|
alert=PROBENOJOIN,5/min,2
|
|
alert=DISASSOCTRAFFIC,5/min,2
|
|
alert=NULLPROBERESP,5/min,5
|
|
alert=BSSTIMESTAMP,5/min,5
|
|
|
|
# Known WEP keys to decrypt, bssid,hexkey. This is only for networks where
|
|
# the keys are already known, and it may impact throughput on slower hardware.
|
|
# Multiple wepkey lines may be used for multiple BSSIDs.
|
|
# wepkey=00:DE:AD:C0:DE:00,FEEDFACEDEADBEEF01020304050607080900
|
|
|
|
# Is transmission of the keys to the client allowed? This may be a security
|
|
# risk for some. If you disable this, you will not be able to query keys from
|
|
# a client.
|
|
allowkeytransmit=true
|
|
|
|
# How often (in seconds) do we write all our data files (0 to disable)
|
|
writeinterval=300
|
|
|
|
# Where do we get our manufacturer fingerprints from? Assumed to be in the
|
|
# default config directory if an absolute path is not given.
|
|
ap_manuf=ap_manuf
|
|
client_manuf=client_manuf
|
|
|
|
# Use metric measurements in the output?
|
|
metric=false
|
|
|
|
# Do we write waypoints for gpsdrive to load? Note: This is NOT related to
|
|
# recent versions of GPSDrive's native support of Kismet.
|
|
waypoints=false
|
|
# GPSMap waypoint file. This WILL be truncated.
|
|
waypointdata=%h/.gpsdrive/way_kismet.txt
|
|
|
|
# How many alerts do we backlog for new clients? Only change this if you have
|
|
# a -very- low memory system and need those extra bytes, or if you have a high
|
|
# memory system and a huge number of alert conditions.
|
|
alertbacklog=50
|
|
|
|
# File types to log, comma seperated
|
|
# dump - raw packet dump
|
|
# network - plaintext detected networks
|
|
# csv - plaintext detected networks in CSV format
|
|
# xml - XML formatted network and cisco log
|
|
# weak - weak packets (in airsnort format)
|
|
# cisco - cisco equipment CDP broadcasts
|
|
# gps - gps coordinates
|
|
logtypes=dump,network,csv,xml,weak,cisco,gps
|
|
|
|
# Do we track probe responses and merge probe networks into their owners?
|
|
# This isn't always desireable, depending on the type of monitoring you're
|
|
# trying to do.
|
|
trackprobenets=true
|
|
|
|
# Do we log "noise" packets that we can't decipher? I tend to not, since
|
|
# they don't have anything interesting at all in them.
|
|
noiselog=false
|
|
|
|
# Do we log corrupt packets? Corrupt packets have enough header information
|
|
# to see what they are, but someting is wrong with them that prevents us from
|
|
# completely dissecting them. Logging these is usually not a bad idea.
|
|
corruptlog=true
|
|
|
|
# Do we log beacon packets or do we filter them out of the dumpfile
|
|
beaconlog=true
|
|
|
|
# Do we log PHY layer packets or do we filter them out of the dumpfile
|
|
phylog=true
|
|
|
|
# Do we mangle packets if we can decrypt them or if they're fuzzy-detected
|
|
mangledatalog=true
|
|
|
|
# Do we do "fuzzy" crypt detection? (byte-based detection instead of 802.11
|
|
# frame headers)
|
|
# valid option: Comma seperated list of card types to perform fuzzy detection
|
|
# on, or 'all'
|
|
fuzzycrypt=wtapfile,wlanng,wlanng_legacy,wlanng_avs,hostap,wlanng_wext
|
|
|
|
# What type of dump do we generate?
|
|
# valid option: "wiretap"
|
|
dumptype=wiretap
|
|
# Do we limit the size of dump logs? Sometimes ethereal can't handle big ones.
|
|
# 0 = No limit
|
|
# Anything else = Max number of packets to log to a single file before closing
|
|
# and opening a new one.
|
|
dumplimit=0
|
|
|
|
# Do we write data packets to a FIFO for an external data-IDS (such as Snort)?
|
|
# See the docs before enabling this.
|
|
#fifo=/tmp/kismet_dump
|
|
|
|
# Default log title
|
|
logdefault=Kismet
|
|
|
|
# logtemplate - Filename logging template.
|
|
# This is, at first glance, really nasty and ugly, but you'll hardly ever
|
|
# have to touch it so don't complain too much.
|
|
#
|
|
# %n is replaced by the logging instance name
|
|
# %d is replaced by the current date as Mon-DD-YYYY
|
|
# %D is replaced by the current date as YYYYMMDD
|
|
# %t is replaced by the starting log time
|
|
# %i is replaced by the increment log in the case of multiple logs
|
|
# %l is replaced by the log type (dump, status, crypt, etc)
|
|
# %h is replaced by the home directory
|
|
# ie, "netlogs/%n-%d-%i.dump" called with a logging name of "Pok" could expand
|
|
# to something like "netlogs/Pok-Dec-20-01-1.dump" for the first instance and
|
|
# "netlogs/Pok-Dec-20-01-2.%l" for the second logfile generated.
|
|
# %h/netlots/%n-%d-%i.dump could expand to
|
|
# /home/foo/netlogs/Pok-Dec-20-01-2.dump
|
|
#
|
|
# Other possibilities: Sorting by directory
|
|
# logtemplate=%l/%n-%d-%i
|
|
# Would expand to, for example,
|
|
# dump/Pok-Dec-20-01-1
|
|
# crypt/Pok-Dec-20-01-1
|
|
# and so on. The "dump", "crypt", etc, dirs must exist before kismet is run
|
|
# in this case.
|
|
logtemplate=%n-%d-%i.%l
|
|
|
|
# Where do we store the pid file of the server?
|
|
piddir=/var/run/
|
|
|
|
# Where state info, etc, is stored. You shouldnt ever need to change this.
|
|
# This is a directory.
|
|
configdir=%h/.kismet/
|
|
|
|
# cloaked SSID file. You shouldn't ever need to change this.
|
|
ssidmap=ssid_map
|
|
|
|
# Group map file. You shouldn't ever need to change this.
|
|
groupmap=group_map
|
|
|
|
# IP range map file. You shouldn't ever need to change this.
|
|
ipmap=ip_map
|
|
|