Kismetdb to JSON
This tool is available as part of Kismet when built from source, or in the kismet-logtools package, as of 2019-02
.
Device JSON
Kismet stores devices it has seen in the kismetdb log file as JSON dumps containing everything Kismet knows about a device.
Extracting these devices can be done simply using the kismetdb_dump_devices
tool:
$ kismetdb_dump_devices --in some-kismet-file.kismet --out some-json-file.json
Export options
There are several optional parameters you can use when exporting a JSON file:
-
--verbose
Add more status output to the console whilekismetdb_dump_devices
runs. -
--force
By default,kismetdb_dump_devices
will not overwrite the target file if it exists already.--force
will cause it to clobber the destination. -
--skip-clean
By default,kismetdb_dump_devices
runs a SQL Vacuum command to optimize the database and clean up any journal files. Skipping this process will save time on larger captures. -
--json-path
Reformat field names to be compatible with JSON path searching and ELK by rewriting all ‘.’ to ‘_’; For example,kismet.base.key
becomeskismet_base_key
. This is turned on automatically when ELK mode is enabled. -
--ekjson
Export as anekjson
format; Instead of exporting a JSON array of the devices, instead export each device as an object on a single line. While not technically valid JSON, this format can be used to stream processing or inserting into other tools (such as ELK), and can be processed line-by-line with far fewer resources than a single array of all options. This will automatically enable JSON path mode.
Streaming via stdout
Like many other command line tools, specifying -
as the output file will cause kismetdb_dump_devices
to stream the output to the console, making it simple to pipe it to other tools:
$ kismetdb_dump_devices --in some-kismetdb.kismet --out - | python -mjson.tool