2025 09 04 Release 202509R1

Posted on September 4, 2025 by Mike Kershaw / Dragorn ‐ 

2025-09-R1

It having been far too long since a full release, and with a large backlog of improvements and fixes, it’s well past time to call it a release and fix whatever new bugs have arisen and start working on new improvements and features.

Biggest changes

  • A new table display library in the UI adds more reliable pagination, sizing, and display. Columns can be added, removed, resized, and rearranged in the main display panel directly. The display is much more efficient, and shouldn’t exhibit the strange sizing behavior which happened sometimes.
  • Python dependency removed for all datasources. Python keeps changing the asyncio syntax and making other small breaking changes, making packaging Python based tools outside of pip problematic to say the least. RTLSDR and similar sources are now rewritten in pure C.
  • All new datasource/ipc protocol. This replaces the protobufs based protocol, removes another complex library dependency, and adds speed enhancements.
  • Lots of improvements to reduce RAM and CPU use, especially in the fastest packet processing paths.

Upgrading

Upgrading should be as simple as other releases - just make sure to install the datasource tools; make install, the Kismet site packages, and all known distribution packages should take care of this automatically.

The rewritten pure-C datasources replace the legacy Python versions. If manually installed, the old sources should be removed; if installed via the Kismet site packages, the new _v2 versions of the packages should automatically flag the original versions as incompatible and mark them for uninstallation, but if the legacy packages remain installed they should be manually removed.

Remote datasources should be upgraded at the same time as Kismet for maximum functionality and compatibility.

Legacy remote capture sources should still work, so long as Kismet is compiled with protobufs support. The packages from the Kismet site are compiled to link to protobufs, but distributions may choose to drop protobufs immediately - for maximum compatibility, plan on upgrading remote datasources as well; the efficiencies in the new protocol are worth it regardless!

New stuff

  • New UI list library (Tabulator), replacing Jquery Datatables and fixing a large number of weird display quirks which were unaddressable within datatables. Adds dynamic column adding and positioning and smoother display and predictable row heights.
  • ADSB parsed in the Kismet server instead of the datasource
  • Additional Wi-Fi based drone fingerprints
  • Add Pcap-NG UTF-8 JSON attribute under Kismet PEN
  • Add geiger counter support for Radiacode over USB and Radview over Arduino serial
  • Add AntSDR DJI DroneID source
  • Device type icons in the UI
  • Re-implement RTLADSB and RTL433 datasources in C, removing the need for Python after multiple incompatible Python version changes in the 3.x series
  • Deprecate RTLAMR datasource - it can now be handled by RTL433 tuned to 915MHz
  • Expand AP name parsing from IE tags for HP/Aruba, Mist, Ruckus, Aerohive/Extreme, Fortinet
  • Add –version to datasources command lines to identify installed helpers
  • Add version to datasource probe reports to identify local datasource binary versions
  • Add version and remote connection type to remote datasources so help identify remote connections
  • Google Protobufs now option, required only for the now-legacy V2 datasource protocol. Protobufs has been increasingly problematic to try to package and link and has introduced incompatibilities with the pure-C protobufs libraries.
  • Start deprecating the V2 datasource/IPC protocol; compatbility remains to prevent desync with older remote datasources but all installs should be upgraded to the current remote and local datasources which have significant efficiency improvements.
  • New V3 IPC protocol based on msgpack with smarter in-line decode which reduces memory copy load. Built using a bundled msgpack library, removing the dependency on protobufs.
  • SSIDCANARY alert for spotting specific networks

Speed and RAM improvements

  • Faster internal map for storing data (ankerl::unordered_dense)
  • String cache for reducing RAM use
  • Rewrite packet time comparison to remove a function call per packet
  • Rewrite pcap-ng internal filter and component selectors to compile-time functors to eliminate a function indirection per packet
  • Rewrite JSON name converstion to compile-time functor for speed
  • Rewrite packet chain stages to eliminate std::function redirection and replace with compile-time functions
  • Optimize all element cloning functions inside tracked elements
  • Refactor use of smart pointers to reduce unnecessary pointer sharing and atomic increment/decrement in fast code paths
  • Rewrite dot11 IE tag parsing to greatly reduce heap allocation and needless thrash
  • Avoid constructing temporary strings in commonly used printable formatting functions
  • Optimize datasource and entrytracker access for fast-path code
  • Completely revamp IPC handling to reduce or entirely remove memory copies on incoming IPC data, using the new msgpack v3 protocol
  • Rewrite all IO into a global buffer pool to reduce allocations and copies
  • Remove copying of packet data during receive in the IPC, instead using a buffer pool and direct reading of the incoming packet from the IPC frame
  • Rewrite and optimize the BPF filters for Wi-Fi capture
  • Rewrite timer calculations to make events tick on predictable intervals, changing logic from ticking on tenth of a second after the last event, to ticking at one tenths of a second predictably
  • Convert tracked field IDs to uint16 to save RAM - two bytes doesn’t sound like much but there can be millions of tracked fields in a larger session

The great bug roundup

The collection of bugs and minor improvements includes, but likely isn’t limited to:

  • C++20 compilation fixes
  • WiFi Coconut compilation fixes
  • Channel update and display refinement
  • Handle more modern WPA3 modes and cache encryption strings
  • Add IE 35 advertised power tag handling
  • Add udev rules for NRF sniffers
  • Allow building Linux without wext (mac80211 only)
  • Fix building on OpenBSD
  • Fix string searching in some string fields
  • Fix TPMS pressure display
  • Rewrite ADSB display plugin to load dynamically and have less weird quirks
  • Update font-awesome
  • Add byte-search function to IPC ringbuffers
  • Rewrite datasource capture framework signal masking and processing
  • Rewrite datasource capture framework spawned process monitoring and halting
  • Add ability to hide phy handlers from the UI to prevent phy-like handlers with no user component cluttering up the view
  • Improve channel assignment to Wi-Fi source devices when they may not be wireless devices
  • Update JQuery
  • Update bundled Boost library
  • Update bundled libfmt library
  • Expand functionality of time-series RRD data
  • Fix zigbee 802.15.4tap header generation
  • Include a precompiled protobuf-c for legacy protobuf code now that protobuf-c is incompatible with the latest Google Protobufs releases
  • Fix creation of sub-tracked-components not using the entrytracker generation functions
  • Fix UAV location handler wiping out the global last-known location records
  • Upgrade Kaitai runtime
  • Revamp display of coordinates in the UI
  • Add a stepped graph display option in preferences
  • Fix missing data fill functions in time-series RRD
  • Clean up GPSd data parsing in some broken situations
  • Close sockets properly in datasource capture framework
  • Fix FD_CLOEXEC and FD_SET issues in datasource capture framework
  • Rework exec’d IPC descriptor and stderr/out mapping in datasource capture framework
  • Fix IPC handling closeed exec’d pipes in datasource capture framework
  • Add –enable-homebrew flag for simpler building on macOS
  • Expand rtlsdr C integration to allow bias-t api use
  • Fix GPS insertion in the LinuxHCI bluetooth data source
  • Refactor printable character mangling and memory buffer to support const memory
  • Fix PCRE2 matches not handling match results properly, impacting regex endpoints, alerts, and other features
  • Handle gcc13/14 warnings slightly more gracefully
  • Handle libfmt+exceptions, and some other libfmt attributes, under c++20 compilers
  • Fix name censorship on the signal monitor window
  • Replace unreliable rtlsdr find-by-serial-number functions
  • Remove some bashisms from autoconf
  • Fix filter merging logic
  • Add missing regex to /devices/last-time endpoints
  • Add json format options to websocket subscriptions
  • Clean up channel list processing in linuxwifi
  • Fail sooner during probing in linuxwifi
  • General GPSd handler improvements
  • Remove channel sub-panel expander; it didn’t work right and broke things
  • Fix race conditions in the UI closing panel windows
  • Fix some tag closings in the web UI making some browsers cranky
  • Disable disconnect/deauth code alert by default since more APs use arbitrary error codes in non-relevant ways
  • Fix crashes in 802.15.4 decoding hitting null pointers
  • Fix language around errors in the wiglecsv tool
  • Rewrite OUI and ICAO generation scripts
  • Fix time-series RRD configured for extreme measurement so that it uses extremes, and not average, in all cases
  • Protect entrytracker creation from deadlocks/corruption between threads in some creation patterns
  • Time-series RRD fixes to address the wobble in device counts in the memory panel
  • Eliminate some unnecessary thread spawning in some log paths
  • Various javascript errors fixed
  • Fix databaselog not properly obeying kis_log_data_packets
  • General trailing whitespace cleanup on code (cosmetic, no functional difference)
  • Alphabetize the datasource list in the UI

Download

You can get the 2025-09-R1 release from the Kismet downloads page, where you can get both the source and packages for several distributions.

Packaging

If you’re looking to package Kismet, have a look at the packaging guidelines. For this release, I’d encourage maintainers to continue packaging protobufs and the v2 protocol for now to make upgrading easier, before deprecating it fully next release.

Thanks

As always, a tremendous thank you to all the supporters on Github Sponsors!