Let's start using pcaps.

This commit is contained in:
Yaro Kasear 2025-04-11 09:33:51 -05:00
parent 1ed992e1d4
commit ec2bbc43a4
2 changed files with 31 additions and 3 deletions

View file

@ -45,6 +45,30 @@ def get_clients_on_ap(capture, ap_bssid):
return len(clients) return len(clients)
def get_clients_on_channel(capture, ap_channel, ap_bssid):
clients = set()
ap_bssid = ap_bssid.lower() # Normalize for comparison
ap_channel = str(ap_channel) # Ensure channel is a string for comparison
for packet in capture:
try:
if not hasattr(packet, 'wlan'):
continue
channel = getattr(packet.wlan, 'channel', None)
sa = getattr(packet.wlan, 'sa', '').lower()
da = getattr(packet.wlan, 'da', '').lower()
bssid = getattr(packet.wlan, 'bssid', '').lower()
# Check if the packet is on the specified channel and not from the AP
if channel == ap_channel and (sa != ap_bssid and da != ap_bssid):
clients.add(sa)
clients.add(da)
except AttributeError:
continue
return len(clients)
def analyze_pcap(pcapng_path, start_ts, end_ts, ap_bssid, ap_channel): def analyze_pcap(pcapng_path, start_ts, end_ts, ap_bssid, ap_channel):

View file

@ -20,8 +20,12 @@ sudo -v
while true; do sudo -n true; sleep 60; done 2>/dev/null & while true; do sudo -n true; sleep 60; done 2>/dev/null &
SUDO_KEEPALIVE_PID=$! SUDO_KEEPALIVE_PID=$!
echo "Starting kismet..."
sudo systemctl start kismet sudo systemctl start kismet
echo "Saturating the capture..."
sleep $LEAD_TIME sleep $LEAD_TIME
# Function to get current TX failed count # Function to get current TX failed count
@ -100,14 +104,14 @@ done
echo "Enriching the data..." echo "Enriching the data..."
KISMET_LOG=$(find ~/kismet_logs -type f -name "*.kismet" -printf "%T@ %p\n" | sort -n | tail -1 | cut -d' ' -f2-) KISMET_LOG=$(find ~/kismet_logs -type f -name "*.pcapng" -printf "%T@ %p\n" | sort -n | tail -1 | cut -d' ' -f2-)
if [ -z "$KISMET_LOG" ] || [ ! -f "$KISMET_LOG" ]; then if [ -z "$KISMET_LOG" ] || [ ! -f "$KISMET_LOG" ]; then
echo "[!] Kismet log file not found." echo "[!] Packet capture not found."
exit 1 exit 1
fi fi
python3 $SCRIPT_DIRECTORY/kismet_enrich_csv.py --csv $TEST_FILE --kismet "$KISMET_LOG" --output "$ENRICHED_FILE" python3 $SCRIPT_DIRECTORY/kismet_enrich_from_pcap.py --csv $TEST_FILE --pcapng "$KISMET_LOG" --output "$ENRICHED_FILE"
# Final email with attachment # Final email with attachment
echo "The test with UID ${BOOT_ID} is complete. Please collect the probe. Data is attached." | \ echo "The test with UID ${BOOT_ID} is complete. Please collect the probe. Data is attached." | \