I'm trying to develop an IDS/IPS system project to include these elements:

A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1) A Linux server (Running Kismet server + client)

I have successfully installed Kismet drone/server on their respective platforms. But I have heard that Snort is rather more well-implemented for an IDPS system.

  1. Is there a way to pass packets captured by Kismet to Snort IDS? I have looked on the internet but I have only found outdated and incomplete answers.

  2. Would it be a good idea to develop this system by just using Kismet as an IDS, without using Snort at all?

  3. Any other ideas and suggests are mostly welcome, thank you.

  • What are you hoping to detect? Kismet doesn't have IDS rules for detecting attacks... Kismet is mostly for wireless auditing. Why not just run Snort at the perimeter?
    – David
    Commented Mar 18, 2013 at 21:36
  • I use kismet to capture 802.11 frames from the air, it captures both layer 2 and layer 3 packets. From what I'm aware snort can analyze only the layer 3 packets. There are under twenty number of layer 2 IDS alerts built in with kismet as well. Actually I've found the answer to this question of mine, I might post it in full later. For now I'd say just set kismet tun/tap function to 'true'. Cheers. I'd appreciate if anyone can point out if it's possible to develop IDS/IPS using these captured packets in some way? Maybe Python? With Genetic Algorithm?
    – nixor01
    Commented Mar 19, 2013 at 20:26

1 Answer 1


I think libpcap and/or tcpdump are what you're looking for. Kismet is a wireless analyzer that will display the 802.11 metadata. There was some activity awhile ago to add 802.11 intrusion detection capabilities (snort-wireless). You might still find useful remnanats of that.

Kismet pulls the 802.11 frame data and analyzes that, then examines some of the TCP/IP data (when it's unencrypted or decrypted) for additional network activity reporting. Kismet can also log the captured data, which you could then feed into an IDS (or any other process) using tcpreplay.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .