Devices

Returns devices which have been active (traffic observed from the device address) since the supplied timestamp.

Timestamps can be absolute or relative.

This endpoint is most typically used to repeatedly monitor recent devices, but can be replaced with the more efficient push-style device monitoring websocket below for many use cases.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Fetch a complete device record (with optional simplification), indexed by the device key.

Typically a UI would use this endpoint to fetch a full device for displaying device details.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Fetch devices which match the supplied MAC address.

It is possibkle (though usually not likely) that there may be MAC address collisions between different PHY types. This becomes more likely when using either non-Wi-Fi datasources which synthesize completely artificial MAC addresses for indexing when no actual MAC address is available (such as RTL-433, ADSB, and other SDR based datasources), or when capturing two wireless devices from the same physical component, like a combo Wi-Fi/Bluetooth.

This API will always return a list of devices, even when only one device matches the supplied MAC address.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Fetch devices matching any of multiple MAC address (or partial MAC address).

Typically this endpoint would be used to monitor the presence of target devices.

This API always returns a list of devices, even if only one device is matched.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Fetch devices matching any of multiple device keys.

Typically this endpoint would be used to monitor the presence of target devices.

This API always returns a list of devices, even if only one device is matched.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Fetch devices matching any of multiple device keys.

Typically this endpoint would be used to monitor the presence of target devices.

This API returns a JSON dictionary of devices, indexed by device key.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

A device view endpoint which automatically filters devices by datasource.

Only devices seen by the specified datasource UUID will be returned.

For complete documentation, check the device view api

A device view endpoint which automatically filters devices by datasource.

Only devices which have been active since the specified time and seen by the specified datasource UUID will be returned.

For complete documentation, check the device view api

A device view endpoint which automatically sorts devices by phy layer type.

For complete documentation, check the device view api

A device view endpoint which automatically sorts devices by phy layer type.

Devices which have been active since the specified time will be returned.

For complete documentation, check the device view api

Kismet devices contain a collection of arbitrary tag fields which are held in the kismet.device.base.tags tree.

These tags can be used to store persistent notes or other data, either user-supplied or auto-generated.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Kismet can raise alerts when a device (by MAC address) is seen, or has been seen and is no longer present. These alerts are configured by the kismet_alerts.conf options devicefound and devicelost.

The list of devices being monitored can be viewed and altered realtime using these APIs.

Kismet can raise alerts when a device (by MAC address) is seen, or has been seen and is no longer present. These alerts are configured by the kisemt_alerts.conf options devicefound and devicelost.

The list of devices being monitored can be viewed and altered realtime using these APIs.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Devices can be monitored in realtime using the device monitor websocket API, which will push device changes to listeners as they occur.

By subscribing to devices, or groups of devices, a client can receive a push event of the device record.

The device data pushed can also be simplified by the standard field simplification.

The device monitoring subscription API accepts JSON objects with a subscription or removal request for a device or group of devices specified by key, MAC, or group MAC, and optional field simplification.

Subscription API #

Multiple subscriptions can be made on a single websocket connection, so long as each subscription request has a unique ID. Use of duplicate IDs will automatically unsubscribe the previous subscription.

Removal API #

To cease monitoring a device (or group of devices) without disconnecting the websocket, use the unsubscribe API.

Constructing and connecting a websocket uses the standard Javascript websocket API, we’ll request all devices with the OUI of AA:BB:CC, updated at once per second, fetching the key, last-active time, and last signal level.

var ws = new WebSocket('ws://host:2501/devices/monitor.ws?'
  'user=username&password=password');
ws.onmessage = function(msg) {
    var json = JSON.parse(msg.data);
    console.log(json);
}
ws.onopen = function(event) {
    var req = {
        "monitor": "AA:BB:CC:00:00:00/FF:FF:FF:00:00:00",
        "request": 31337,
        "rate": 1,
        "fields": [
          "kismet.device.base.key",
          "kismet.device.base.last_time",
          "kismet.device.base.signal/kismet.common.signal.last_signal"
        ],
    }
    ws.send(JSON.stringify(req));
}

This would return pushed records like:

{
  "kismet.common.signal.last_signal": -77,
  "kismet.device.base.last_time": 1605736428,
  "kismet.device.base.key": "4202770D00000000_AABBCCDDEEFF"
}

{
  "kismet.common.signal.last_signal": -81,
  "kismet.device.base.last_time": 1605736427,
  "kismet.device.base.key": "4202770D00000000_001122334455"
}

Which would be highly appropriate for monitoring signal levels of a group of devices, for instance.

This endpoint can run smaller systems out of memory and is generally not encouraged.

A much safer method is to use the device view API all view, using sort-by first seen and a sliding window.

This is a special ekjson endpoint which provides a dump of all devices.

This endpoint only supports the ekjson method, and returns one object per row, formatted for use with a tool like Elastic Search.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Returns devices which have been modified since the supplied timestamp.

This is similar to recently active devices, but includes devices which have changed without new traffic being seen, such as a name or tag set through the API. Devices which have seen traffic are also considered modified.

Timestamps can be absolute or relative.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Set a custom name for a device. The name is stored in the kismet.device.base.username field, and is shown in place of the device name.

Device names are stored in the Kismet devicetracker database in the Kismet configuration directory, and are restored when the device is seen again, including across restarts.

Setting a name updates the device modification time, so it is visible to the recently modified devices endpoint.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

Delete a tag from a device, previously set with the editing device tags endpoint. The tag is also removed from the devicetracker database.

Deleting a tag updates the device modification time.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

List the phy (protocol) handlers loaded in Kismet, with the number of devices and packets seen by each.

The phy ID is assigned when Kismet starts, and may change between runs; use the phy name to identify a phy.

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

JSON list of phy records: