2026 10 29 Release 202610R1

Posted on October 29, 2026 by Mike Kershaw / Dragorn ‐ 

2026-10-R1

Insert the usual mea culpa here that it’s been way too long since the last release. It has been. But at least this is a good one, and sets the framework for a lot of future development, and builds a lot of tooling to make future updates simpler.

This release brings a ton of performance fixes, new phy types, new data sources, and bug fixes.

Performance

  • Web UI and REST API: fetching a full device list as JSON is roughly 300 times faster on large lists.
  • Packet processing: the packet chain uses lock-free handler snapshots, per-thread de-duplication and batched reads, and keeps an AP’s packets on one thread.
  • Lookups: the manufacturer, Bluetooth and ICAO databases are cached and no longer looked up under the device list lock.
  • Memory: about 14% less per device from the packet and pool changes, a further 2.8 KB per device from storing RRDs inline, and about 0.65 MB per 5000 APs from not keeping empty 802.11d countries.

New datasources

  • Cellular modems (cellat, celldiag): serving and neighbouring cell towers from Quectel LTE / 5G modems, over AT commands (cellat, with optional band locking) or Qualcomm DIAG (celldiag). Towers are tracked as devices, with a Cell Info panel in the web UI. The DIAG source raises EFF Rayhunter-style alerts for suspicious network behaviour: null ciphering or integrity (CELLNULLCIPHER, CELLNULLINTEGRITY), 2G redirects (CELL2GREDIRECT), incomplete system information (CELLINCOMPLETESIB) and identity requests (CELLIDREQUEST, CELLIDREQNOAUTH). The modem’s GNSS can act as a Kismet GPS, and detailed cell logs are kept in the kismetdb and extracted with the new kismetdb_to_celllog. Modems with no host driver, such as on macOS, are reached over libusb, and the new kismet_usbserial tool serves their AT, DIAG, NMEA and modem ports as pseudo-terminals (--disable-usbserial turns it off). The sources are hardened for suid installs. (Luke Jenkins)
  • Userspace USB Wi-Fi (usbwifi): monitor mode capture on MediaTek MT7921U, MT7925U and MT7612U / MT7632U, and Realtek RTL8812AU / 8811AU, RTL8821AU, RTL8814AU, RTL8812BU / 8822BU, RTL8812CU / 8822CU, RTL8811CU / 8821CU and RTL8723DU adapters. It runs the Linux mt76 and rtw88 drivers in userspace on libusb, so it also works on macOS, with no VM. Firmware is included, and on Linux it’s also loaded from the system firmware directories, zstd or xz compressed. Of the Realtek chips only the RTL8814AU has been tested, and Realtek adapters stay in USB 2 mode. On Wi-Fi + Bluetooth combo adapters, Bluetooth keeps working on Linux.
  • Morse Micro MM8108 USB HaLow (mm8108): 802.11ah capture with a userspace driver on Linux and macOS, with firmware and board configurations included. It hops no faster than every 2 seconds to catch slow HaLow beacons, and several adapters can capture at once.
  • RTL-SDR AIS (rtlais) and AIS + ADS-B (rtlaisadsb): ships, base stations, aids to navigation, SAR aircraft and AIS-SART / MOB / EPIRB beacons, on both AIS channels at once, with an AIS map and NMEA AIVDM websocket feeds for OpenCPN. rtlaisadsb hops one radio between AIS and ADS-B.
  • 802.15.4 and Zigbee: CatSniffer V3 (catsniffer_zigbee, shrout1, RFDeck), and legacy 900 MHz 802.15.4 on an RTL-SDR (zigbee900sdr, shrout1).
  • BLE: Sniffle on a Sonoff ZBDongle-P (sniffle_ble, shrout1), and the WCH BLE Analyzer Pro (wch-ble-pro, yi chen).
  • LoRa: radios running LoraPipe firmware (lorapipe), with Meshtastic regional channel presets.

New features

  • Reported locations kept separate (major change): devices that report their own position (ADS-B, AIS, Remote ID, MeshCore, Meshtastic) keep it in kismet.device.base.reported_location, and the device location always means where Kismet was when it heard them. kismetdb (v11), the maps and kismetdb_to_kml / kismetdb_to_gpx follow suit. See Upgrading.
  • Bluetooth and BTLE decoding:
    • Advertising and EIR data are decoded: company and service names, Device ID, Apple Continuity, Microsoft, Fast Pair, Matter, mesh, LE Audio, sensors, iBeacon, AltBeacon and Eddystone IDs, class of device, appearance, advertised battery levels, and an estimated distance from the advertised transmit power.
    • Location trackers: Apple Find My (AirTag and network accessories), Google FMDN, DULT, Samsung SmartTag, Tile, Chipolo and Pebblebee tags are recognized, with state, battery and whether they’re separated from their owner (RFDeck), and get their own icon in the web UI. A new TRACKERFOLLOW alert is raised for a separated tracker that moves with you.
    • Random addresses are labelled static, resolvable or non-resolvable, and Wi-Fi and BTLE devices that rotate their address can optionally be linked (dot11_link_randomized, btle_link_randomized, off by default).
    • HCI captures (H4, Linux monitor and HCI pcaps) create devices with the remote version, chip maker and firmware.
    • Ubertooth can survey classic Bluetooth piconets (mode=classic), and Linux Bluetooth can actively probe for names or version and features (probe=name|info, off by default).
    • Linux HCI reports RSSI, connectability, service UUIDs and manufacturer data (cadneowl, Matt Miller, shrout1), and resumes scanning after a controller is reset.
    • nRF51822 defaults to the Nordic firmware’s 460800 baud (Sebastian Reitenbach), and it and Sniffle filter packets that fail CRC (shrout1).
  • 802.15.4, Zigbee and Thread (Textile, RFDeck):
    • IEEE 802.15.4-2015 frames, the TAP header read by its TLVs, FCS checking, and the SUN PHYs’ long frames.
    • Zigbee, Thread and 6LoWPAN recognized above the MAC, with device roles, network names, extended PAN IDs and EUI-64 learned from the NWK header.
    • Zigbee key checks: frames are checked against the publicly known keys (ZigBeeAlliance09, ZLL, Z-Stack, Nordic, Legrand and others) and keys sent in the clear, raising a ZIGBEEWEAKKEY alert. Your own keys can be added with zigbee_key= in the new kismet_zigbee.conf; key values are shown only with zigbee_show_keys.
    • Short addresses are tracked per PAN, and destination addresses no longer create devices.
  • Meshtastic and LoRa: Meshtastic decoding, including encrypted channels with the default or configured keys (kismet_meshtastic.conf), with node, telemetry and message tracking; the LoRaTAP format.
  • ANT / ANT+ and nRF24: heart-rate, bike, foot pod and fitness devices, and Logitech / Microsoft nRF24 keyboards and mice, from the nRF24 research dongle or an SDR capture file, with the NRFPLAINTEXTKEYS alert for unencrypted keystrokes. (Textile)
  • 802.11:
    • channel switch announcements, with the DOT11CSACH14, DOT11CSAFLOOD and DOT11CSASPOOF alerts (RFDeck);
    • Broadcom SDK WPS daemon detection, with the BCMWPSMONITOR, WPSFRAGLEN and WPSFRAGPROBE alerts;
    • clients with randomized (locally administered) MACs are flagged;
    • initial 802.11ah / HaLow (S1G) decoding.
  • ADS-B: aircraft from the RTL-SDR sources get a signal level, carried in the Beast feed, and new aircraft get their manufacturer.
  • Remote capture: tools try every address of the server’s name, so IPv6 and --tcp over IPv6 work; connecting --tcp to the web server port says so; and probe and websocket errors are readable.
  • GPS: serial GPS autodetection (baud rate, NMEA / u-blox UBX / SiRF), signal quality (satellites, DOP, estimated error), and the satellites in view, shown in the web UI and logged to kismetdb as GPSSATS every kis_log_gps_satellites_rate seconds.
  • Logging: the in-memory pcapng_ring log with on-demand snapshots (Costa), WiGLE CSV 1.6 with frequency and Bluetooth devices, signal levels on kismetdb data records (v10), and JSON packet data logged directly.
  • REST API: new endpoints for AIS map data and AIVDM feeds, deleting a device tag, devices modified since a time (RFDeck), pcapng ring snapshots and Meshtastic channels; many new tracked fields (GPS, Bluetooth, 802.15.4, AIS, Meshtastic, datasource packet counts, and per-device min / max signal history); and kismet.datasource.channel_spans, the frequencies each SDR source’s channels cover.
  • Console status display: started on a terminal, Kismet shows the web UI address, per-source packet graphs, device and memory graphs, and server messages.
  • Web UI: an 802.15.4 device panel (Textile), Cell Info, broader censor mode (censor_heavy=1), invalid / filtered / dropped counts per source, and a hop-rate control that respects the driver’s maximum.
  • Configuration: kismet_site.d/ override directory, per-source channel_hoprate=, and datasource_list_timeout so a slow capture tool can’t hang the interface list.

Bug fixes

Security

  • Capture and remote capture: frame lengths could wrap past the size checks on 32-bit systems, a short legacy v2 frame could be over-read, and BladeRF trusted the radio’s packet length (Tristan). The remote capture protocol was hardened against oversized lengths, unterminated strings, an undersized peek and a use-after-free, and capture agents not on localhost can no longer fetch an HTTP auth token (remote_capture_allow_http_auth restores it). (Daniel Birtwhistle)
  • Web server: a .. path could read files from a directory next to the web root whose name starts with the web root’s name (CWE-22, sighook); API keys with an expiration never expired (RFDeck); and slow or stalled clients are disconnected after 30 seconds instead of holding a thread.
  • hidedata=true now cuts data frames to their headers in the logs and streams, not just in decoding. (RFDeck)
  • Malformed packets no longer read out of bounds or crash the server: PPI GPS (sighook), radiotap, Mode S, CC2540, 802.15.4 tap headers and 802.11 management frames and EAP identities (Ibrahim AlJaafreh), nRF52840 records, radiation spectra, rtl_433 meter records, and REST API field paths that treat a value as a map.
  • Leaked memory contents: WEP-decrypted frames carried uninitialized memory in place of their 802.11 header, and nRF51822 packets carried unset stack memory.
  • Other hardening: JSON output escaping, NaN / Inf and number range; munge_to_printable() output size; RRD samples with negative timestamps; the Linux BTLE sysfs path (Daniel Birtwhistle); capture helper line buffers; stack buffers sized from packet data in several datasources; and an OpenBSD websocket use-after-free (Sebastian Reitenbach).

Server and datasources

  • Capture framework: several helpers exiting at once are all reaped, queued output is no longer thrown away when a write would block, frames go out without up to 500 ms delay, and reporting config before a channel is set no longer crashes.
  • Datasources: an open failure says why, over HTTP too, including when a driver declined the source; a stale error clears once the source opens; a graceful close that times out no longer hangs; block_channels=, duplicate channels and hop skip calculations are fixed; closing an unknown UUID no longer closes the last source (RFDeck); a missing capture tool no longer aborts Kismet; and plugin datasources open at startup (RFDeck).
  • Packet handling: crashes removing a handler under load (RFDeck), deadlocks under heavy load and web use, purged devices staying in views, and timer cancellation are fixed. Unchanging frames repeated more than a second apart (BTLE adverts, ADS-B, AIS, sensors) now count as new packets instead of duplicates.
  • GPS: gpsd is retried when it isn’t running at startup; GPS data is no longer lost once packets are recycled, peak locations aren’t set to 0,0, per-source gps= doesn’t override v3 sources (weebl); a source’s own GPS that loses its fix no longer stamps packets with its last position; device_location_signal_threshold_dbm works again.
  • Web server: logins set in the web UI are read back after a restart; clients holding a non-admin token are no longer refused on routes that need no login (RFDeck); a port already in use is reported.
  • Logging and replay: kismetdb replay keeps each packet’s frequency and survives damaged logs; the kismetdb close race (#644, RFDeck); kismetdb_to_pcap crashes (Sebastian Reitenbach); pcap and kismetdb realtime replay timing; and the pcap end-of-file message being lost.
  • Channel tracker: per-second packet and byte counts were averaged, and device counts dropped on every read.

Protocols and capture tools

  • 802.11: ad-hoc misdetection and the WMMTSPEC alert (RFDeck), last_bssid overwritten by probes (RFDeck), VHT operation parsing (weebl), mesh SSID checksums, WPS details and the WPSBRUTE alert, frames captured short failing the FCS check (RFDeck), and an empty 802.11d country kept for every AP.
  • Bluetooth: BLE CRC and channel handling, packets with a CRC the radio already validated, the FLIPPERZERO alert for BTLE (RFDeck), and devices that only send a shortened name now get it.
  • 802.15.4: per-packet parse state across threads, FCS failures counted as invalid, and BTLE data channel packets no longer creating devices. (Textile, RFDeck)
  • Capture tools: Linux Wi-Fi (renamed wiphys, RFDeck; interface listing, HT40 bands, wext fallback, netlink hangs), OpenBSD Wi-Fi channels (Sebastian Reitenbach), macOS CoreWLAN channel lists, rtl_433 (now always -s 1024k) and rtladsb, nRF52840 (full-size frames, and the macOS hardware flow control flag), RZ Raven / KillerBee, Ubertooth, mousejack, TI CC2531 / CC2540, KW41Z, FreakLabs, Radiacode firmware 5.x, AntSDR DroneID, Coconut, BladeRF, MQTT TLS keys, the Python rtl_433 and BT Geiger helpers, and serial sources spinning on an unplugged device.
  • Web UI: default units follow the config on a clean install (Wessel); the device view selector no longer leaks menu elements (nikqig) or resets while open; the device list keeps its scroll position and row heights (Textile); and popups, the hop rate menu and the datasource panel’s controls behave across refreshes and theme changes.
  • Misc: is_multicast() / is_broadcast() (RFDeck), base64 encoding, the plugin tracker (#602), saved devices with NULL names or tags, and scan report values.

Misc

  • Databases: the manufacturer database merges IEEE, Wireshark and Nmap, about 86,000 entries (Ringmast4r), and the Bluetooth company and ID databases are installed and refreshed for each release.
  • Removed: the deprecated Python rtlamr source and Python rtladsb helper (the C rtladsb helper replaces it), and kismet.channeltracker.channel.
  • Build and platform: OpenBSD fixes (Sebastian Reitenbach); macOS / BSD fixes; libfmt 12.1, nlohmann::json 3.12.0 and backward-cpp updates (Steev Klimaszewski); optional zstd / xz firmware support; C++17 std::string_view; fewer compiler warnings; Docker-based CI; a release script that checks the tree and test builds before tagging; and documentation fixes (Tim Smith).

Upgrading

  • Device locations: for ADS-B, AIS, Remote ID, MeshCore and Meshtastic devices, kismet.device.base.location, location_cloud and the kismetdb location columns now hold Kismet’s GPS position. Read reported_location / reported_location_cloud or the kismetdb reported_* columns for the device’s own position.
  • kismetdb logs are now version 11; older tools may not read the new data.
  • API keys with an expiration now expire, and remote capture agents not on localhost need remote_capture_allow_http_auth=true to fetch an auth token.
  • Alerts: BLEEDINGTOOTH and DISCONCODEINVALID are off by default.
  • Device keys: 802.15.4 short-address devices are keyed by PAN and short address, and nRF24 dongle devices by their 5-byte address, so both show up as new devices. Devices wrongly marked as Wi-Fi ad-hoc keep that type in a saved device database until it’s cleared.
  • Removed sources: remove rtlamr sources and MQTT mapping=RTLamr from configs; the python3-kismetcapturertladsb package can be removed.
  • Channel tracker clients using kismet.channeltracker.channel need updating.
  • Strings with NUL or non-UTF-8 bytes now show escaped (\u0000, \xNN).

Thanks

Thanks to everyone who contributed code, testing and reports for this release: RFDeck, Textile, shrout1, Luke Jenkins, Sebastian Reitenbach, weebl, Matt Miller, Ringmast4r, Tim Smith, Costa, yi chen, Wessel, nikqig, cadneowl and Steev Klimaszewski; and for security and bug reports, Daniel Birtwhistle, Ibrahim AlJaafreh, TwoBottomBuns, sighook and Tristan.

And as always, a huge thanks to the GitHub sponsors who help keep things going with hardware and server costs!