CatSniffer and Kismet for Zigbee Network Analysis

CatSniffer and Kismet for Zigbee Network Analysis

Find the full video in YouTube:

Overview

What is Kismet?

Kismet is an open-source wireless network discovery and wireless intrusion detection system (WIDS). Unlike tools that rely on active scanning (transmitting probes to elicit responses), Kismet utilizes passive monitoring. Operating as a silent observer, it captures radio frequency (RF) traffic without transmitting data, making it an effective tool for mapping networks stealthily without disrupting the wireless ecosystem.

Kismet features a modular architecture designed to aggregate data from multiple hardware sources simultaneously. Through its web-based dashboard, it visualizes device relationships, manufacturer signatures, and signal metrics in real-time. When applied to the IEEE 802.15.4 standard (the physical layer for Zigbee), Kismet can discover and map smart home devices, sensors, and mesh gateways. Learn more about Kismet on their official website: https://www.kismetwireless.net/

Environment setup

Prerequisites

1. Install Kismet in your system following the official instructions in the Kismet Installation section.

Note

If using Linux, it is recommended to first check and update the system repository lists:

sudo apt update && sudo apt upgrade

2. Additionally, it is recommended to have Catnip installed for easy firmware flashing. Learn more about how to install Catnip here: Catnip installation.

Hardware configuration

Important

The instructions from now are based on a Linux installation.

To interface with Kismet, the CatSniffer must be flashed with the specific Texas Instruments sniffer firmware using the catnip command-line utility.

1. Open a new terminal session.

2. Connect the board to the computer.

3. Verify hardware detection by sending the command:

catnip devices

4. Flash the sniffer firmware by using the command:

catnip flash ti_sniffer

Expected flashing output:

ℹ Flashing firmware: ti_sniffer to device: CatSniffer #1
  Resolved 'ti_sniffer' to ti_sniffer -> sniffer_fw_Catsniffer_v3.x.hex
ℹ Opening bridge port COM50 at baud: 500000
ℹ Sending boot command via shell port: COM49
ℹ Boot command sent successfully
ℹ Chip ID: 0xF000 (CatSniffer CC1352 (Bootloader Mode))
ℹ Chip details:
  Package: CC1350 PG2.0 - 704 KB Flash - 20KB SRAM - CCFG.BL_CONFIG at 0x000AFFD8
  Primary IEEE Address: 00:12:4B:00:29:B6:82:3C
ℹ Performing mass erase
✓ Erase done
✓ Write done
ℹ Verifying by comparing CRC32 calculations.
✓ Verified match: 0x52c24bf8
ℹ Sending exit command via shell port
ℹ Exit command sent successfully
ℹ Waiting for device to initialize after reset...
ℹ Metadata update attempt 1/5...
    ├─ Testing shell responsiveness...
    ├─ Shell responsive, updating metadata...
    └─ Metadata updated successfully
✓ Firmware metadata updated successfully
ℹ Waiting for device to restart...
✓ Device restart complete. Firmware is ready to use!
ℹ Sending identification command to CatSniffer #1...
ℹ Device response: identifyIdentifying board...
✓ Identification command sent to device #1!

Operation and Data Collection

Because Kismet does not auto-detect the CatSniffer by default, the device must be explicitly defined as a data source when launching the service.

Launching Kismet with CatSniffer

1. Connect the flashed CatSniffer to the host system and initialize Kismet from the terminal, specifying the correct serial port (/dev/ttyACMXX), a custom source name, and channel parameters.

Command:

kismet -c "catsniffer_zigbee:device=/dev/ttyACMXX,name=Source_Name,channel_hop=false/true,channel=XX"

Usage example:

kismet -c "catsniffer_zigbee:device=/dev/ttyACM0,name=Peqe,channel_hop=true,channel=25"

Setting channel_hop=true forces the CatSniffer to cycle through valid Zigbee channels automatically to map the entire environment.

2. Once initialized, Kismet will display an IP address and port in the terminal console.

3. Open a web browser and navigate to the provided address (e.g., hhtp://localhost:2501). Otherwise, open the IP address by clicking on the terminal console.

Navigating the Web Dashboard

1. Create an admin username and password upon first login.

2. Navigate to the Hamburge Menu > Data Sources to monitor device connection status, modify channel lists, or adjust channel-hopping parameters.

3. Click on the individual packets or device nodes within the dashboard to access deep inspection views, device IDs, and signal metadata.

Use case example: By analyzing the "Seen By" matrices and Signal Graphs within Kismet, administrators can track down physical device locations within a facility. If a sensor reports a weak signal, Kismet can identify the exact Zigbee Router node it is hopping through, isolating mesh topology and connectivity faults that standard consumer applications mask.

Packet Analysis via Wireshark Export

For deep packet inspection, raw data can be converted to standard network analysis formats. Kismet stores all packet captures natively in an SQLite-based .kismet database file. This can be converted to a Wireshark-compatible PCAP-NG file using the integrated conversion utility.

Command:

kismetdb_to_pcap --in your_log_file.kismet --out zigbee_capture.pcapng

Once opened in Wireshark, operators can inspect Zigbee Cluster Library (ZCL) commands. If the network's Trust Center Link Key is known, traffic can be fully decrypted to audit plain-text exposure of commands (e.g., smart lock states or sensor alerts).