0

I'm trying to figure out what information about my infrastructure can leak through Wi-Fi.

I ran Kismet and was surprised to see that a few minutes later, Kismet displayed not only the MAC addresses of mobile devices connected to my Wi-Fi, but also MAC addresses of devices which don't use Wi-Fi, such as the Ethernet surveillance camera or a bunch of virtual machines hosted on the servers which have no Wi-Fi access. This, obviously, is not very pleasing, since I don't expect anyone parked outside the building for a few hours to get an exact picture of the infrastructure.

  • How does Kismet know about those devices? I'm quite sure virtual machines I've seen in the list don't broadcast anything, so what is happening here?

  • What do I do in order to prevent this sort of information from leaking to anyone ready to listen to it? Wi-Fi access points are on the same network (i.e. they are connected to the same switch as the servers, and use the same network parameters), which, as I imagine, is a really bad idea. Should I get a dedicated network for them (with a router in the middle), or are there alternatives?

1

In the absence of a technical answer about Kismet, I think your best bet is to run a packet capture. Although your ethernet devices might not broadcast, your network may be configured as an unswitched zone and every node can see every other node's traffic.

If you can see all that traffic on WiFi, then your answer isn't about Kismet at all, but about your network design. Try that first.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.