Quote:
Originally posted by xaphan
I've had a capture running for about two hours today, and I'm having trouble swallowing the output. I've "seen" about 180k packets so far, and kismet has clearly identified about 15 distinct SSIDs and > 20 APs.
The part I'm having trouble with is the >16,000 <no ssid> networks it's reporting. Most of these appear to have similar MAC addresses, so I'm wondering if something is being scrambled and misinterpreted. Has anyone else seen anything similar?
|
If the <no ssid> lines have a P in the Type column (instead of an A), then they very well could just be probing clients. I can't imagine that there would be 16,000 individual ones though.
What I have seen is Kismet go a little crazy when the channel hopping is too fast. If I load up Airsnort and use the orinoco_hopper built into it then Kismet goes a bit nuts (it hops faster than the orinoco_hopper script you can download seperately). When I run the other orinoco_hopper script though, Kismet works just fine and doesn't pick up a lot of "ghost" networks with <no ssid>.
You might try slowing down the channel hopping rate.