Kismet can provide a live stream, in pcap-ng format, of all packets since the time of this request seen by Kismet from all datasources. The pcap-ng file can be post-processed with tshark or wireshark to strip it to a single interface if necessary. Typically, libpcap based tools can easily process a pcap-ng file with a single source but may have difficulty processing files with multiple sources. This format can be read and processed by Wireshark and tshark but may not be compatible with all traditional libpcap-based tools. The pcap-ng format allows for multiple interfaces and linktypes to be stored in a single file. Tools such as Wireshark (and tshark) can process complete pcapng frames, while tcpdump and other libpcap based tools (currently including Kismet) can process the simpler version of pcapng. Kismet can export packets in the pcap-ng format this is a standard, extended version of the traditional pcap format.
0 kommentar(er)
