Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to develop an IDS/IPS system project to include these elements:

A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1) A Linux server (Running Kismet server + client)

I have successfully installed Kismet drone/server on their respective platforms. But I have heard that Snort is rather more well-implemented for an IDPS system.

  1. Is there a way to pass packets captured by Kismet to Snort IDS? I have looked on the internet but I have only found outdated and incomplete answers.

  2. Would it be a good idea to develop this system by just using Kismet as an IDS, without using Snort at all?

  3. Any other ideas and suggests are mostly welcome, thank you.

share|improve this question
    
What are you hoping to detect? Kismet doesn't have IDS rules for detecting attacks... Kismet is mostly for wireless auditing. Why not just run Snort at the perimeter? –  David Mar 18 '13 at 21:36
    
I use kismet to capture 802.11 frames from the air, it captures both layer 2 and layer 3 packets. From what I'm aware snort can analyze only the layer 3 packets. There are under twenty number of layer 2 IDS alerts built in with kismet as well. Actually I've found the answer to this question of mine, I might post it in full later. For now I'd say just set kismet tun/tap function to 'true'. Cheers. I'd appreciate if anyone can point out if it's possible to develop IDS/IPS using these captured packets in some way? Maybe Python? With Genetic Algorithm? –  nixor01 Mar 19 '13 at 20:26

1 Answer 1

up vote 2 down vote accepted

I think libpcap and/or tcpdump are what you're looking for. Kismet is a wireless analyzer that will display the 802.11 metadata. There was some activity awhile ago to add 802.11 intrusion detection capabilities (snort-wireless). You might still find useful remnanats of that.

Kismet pulls the 802.11 frame data and analyzes that, then examines some of the TCP/IP data (when it's unencrypted or decrypted) for additional network activity reporting. Kismet can also log the captured data, which you could then feed into an IDS (or any other process) using tcpreplay.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.