Using Kismet to Find Networks by Probe Requests

Sometimes you can discover the existence of a network and some of its configuration parameters even when that access point is completely out of range. You can do this because most idle computers remember which networks they have been connected to in the past and send out probe request frames in an attempt to reconnect. This means that an idle laptop that an employee has taken home for the night can reveal to us the configuration of his office network.

In Kismet, networks that have been discovered from probe requests are placed in a special group called Probe Networks. This works like any other group in Kismet; to expand it and see the discovered networks, first be sure you are not in automatic sorting mode, then highlight this group and press +. Alternatively, you can highlight Probe Networks and press the I key to get a list of networks with full network information.

This feature can really help out on tough network assessments where the access points have all been correctly configured to hide network information. On an idle network, this is sometimes the only thing you have to go on. For example, one time we couldn't find the network SSID for the target network, and just as we gave up and started to drive off we found a laptop sending probe requests from a company van parked down the street that gave us all the information we needed.

Knowing which clients are probing for networks that are not there is also helpful when using tools such as Karma, which is discussed in Karma.