Devices

Returns devices which have been active (traffic observed from the device address) since the supplied timestamp.

Timestamps can be absolute or relative.

This endpoint is most typically used to repeatedly monitor recent devices, but can be replaced with the more efficient push-style device monitoring websocket below for many use cases.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Fetch a complete device record (with optional simplification), indexed by the device key.

Typically a UI would use this endpoint to fetch a full device for displaying device details.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Fetch devices which match the supplied MAC address.

It is possibkle (though usually not likely) that there may be MAC address collisions between different PHY types. This becomes more likely when using either non-Wi-Fi datasources which synthesize completely artificial MAC addresses for indexing when no actual MAC address is available (such as RTL-433, ADSB, and other SDR based datasources), or when capturing two wireless devices from the same physical component, like a combo Wi-Fi/Bluetooth.

This API will always return a list of devices, even when only one device matches the supplied MAC address.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Fetch devices matching any of multiple MAC address (or partial MAC address).

Typically this endpoint would be used to monitor the presence of target devices.

This API always returns a list of devices, even if only one device is matched.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Fetch devices matching any of multiple device keys.

Typically this endpoint would be used to monitor the presence of target devices.

This API always returns a list of devices, even if only one device is matched.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Fetch devices matching any of multiple device keys.

Typically this endpoint would be used to monitor the presence of target devices.

This API returns a JSON dictionary of devices, indexed by device key.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

A device view endpoint which automatically filters devices by datasource.

Only devices seen by the specified datasource UUID will be returned.

For complete documentation, check the device view api

A device view endpoint which automatically filters devices by datasource.

Only devices which have been active since the specified time and seen by the specified datasource UUID will be returned.

For complete documentation, check the device view api

A device view endpoint which automatically sorts devices by phy layer type.

For complete documentation, check the device view api

A device view endpoint which automatically sorts devices by phy layer type.

Devices which have been active since the specified time will be returned.

For complete documentation, check the device view api

Kismet devices contain a collection of arbitrary tag fields which are held in the kismet.device.base.tags tree.

These tags can be used to store persistent notes or other data, either user-supplied or auto-generated.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Kismet can raise alerts when a device (by MAC address) is seen, or has been seen and is no longer present. These alerts are configured by the kismet_alerts.conf options devicefound and devicelost.

The list of devices being monitored can be viewed and altered realtime using these APIs.

Kismet can raise alerts when a device (by MAC address) is seen, or has been seen and is no longer present. These alerts are configured by the kisemt_alerts.conf options devicefound and devicelost.

The list of devices being monitored can be viewed and altered realtime using these APIs.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Devices can be monitored in realtime using the device monitor websocket API, which will push device changes to listeners as they occur.

By subscribing to devices, or groups of devices, a client can receive a push event of the device record.

The device data pushed can also be simplified by the standard field simplification.

The device monitoring subscription API accepts JSON objects with a subscription or removal request for a device or group of devices specified by key, MAC, or group MAC, and optional field simplification.

Subscription API #

Multiple subscriptions can be made on a single websocket connection, so long as each subscription request has a unique ID. Use of duplicate IDs will automatically unsubscribe the previous subscription.

Removal API #

To cease monitoring a device (or group of devices) without disconnecting the websocket, use the unsubscribe API.

Constructing and connecting a websocket uses the standard Javascript websocket API, we’ll request all devices with the OUI of AA:BB:CC, updated at once per second, fetching the key, last-active time, and last signal level.

var ws = new WebSocket('ws://host:2501/devices/monitor.ws?'
  'user=username&password=password');
ws.onmessage = function(msg) {
    var json = JSON.parse(msg.data);
    console.log(json);
}
ws.onopen = function(event) {
    var req = {
        "monitor": "AA:BB:CC:00:00:00/FF:FF:FF:00:00:00",
        "request": 31337,
        "rate": 1,
        "fields": [
          "kismet.device.base.key",
          "kismet.device.base.last_time",
          "kismet.device.base.signal/kismet.common.signal.last_signal"
        ],
    }
    ws.send(JSON.stringify(req));
}

This would return pushed records like:

{
  "kismet.common.signal.last_signal": -77,
  "kismet.device.base.last_time": 1605736428,
  "kismet.device.base.key": "4202770D00000000_AABBCCDDEEFF"
}

{
  "kismet.common.signal.last_signal": -81,
  "kismet.device.base.last_time": 1605736427,
  "kismet.device.base.key": "4202770D00000000_001122334455"
}

Which would be highly appropriate for monitoring signal levels of a group of devices, for instance.

The device summary API is the base API beneath a scrollable view of devices Kismet is tracking.

It is designed to be connected to a jquery-datatables view, but can be used by any UI mechanism with a concept of a scrolling sub-view.

Whenever possible, a UI is highly encouraged to use a scrolling window mechanism to view the devices: Kismet can track tens or hundreds of thousands of devices, and trying to render them all as a single view will likely over-tax both the Kismet server and whatever is rendering the UI.

When in datatables mode (datatable set to true in the JSON argument), this API takes additional FORM variables from the jquery-datatables implementation.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

This endpoint can run smaller systems out of memory and is generally not encouraged.

A much safer method is to use the device view API all view, using sort-by first seen and a sliding window.

This is a special ekjson endpoint which provides a dump of all devices.

This endpoint only supports the ekjson method, and returns one object per row, formatted for use with a tool like Elastic Search.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.