[ Wardriving with Kismet and Your Android Phone's GPS ]

In March 2015 I wrote up how to feed an Android phone's GPS into Kismet, so
every network it logged landed on a map. That write-up is still one of the
most-read pages on this site, and nearly everything in it has aged out. The
phone app is gone, the mapping tool reads a log format Kismet no longer writes
by default, and Kali's package names have moved on.

This is the 2026 version. The original stays up for history.

The idea hasn't changed. Kismet listens passively for Wi-Fi devices (and
Bluetooth, and more), the phone tells it where you are, and afterward you turn
the log into a map:

  phone GPS -> gpsdRelay -> USB tether -> gpsd -> Kismet -> map

_________________________________________________
__________________10000000000011__________________
_______________10000000000000000001_______________
_____________00000000000000000000000______________
____________00000111000000001111100001____________
__________10001_______10001_______10001___________
_________1000__________11___________000___________
_________0001_____101_______11______1000__________
_________000______101_______11______1000__________
________10001___________1___________10001_________
________100001_________101_________100001_________
________10000001_____1000001_____10000001_________
_________0000000000000000000000000000000__________
_________1000000000001______100000000000__________
__________000000001____________100000001__________
___________0000001______________1000001___________
____________00000____10000001____00001____________
_____________0000__100000000000_1001____111_______
______1________0000000000000000001_____00000______
_____00000________11000000000001____1000000011____
_____00000001_____________________100000000000____
____0000000000001______________100000000000001____
____000000000000000011_____110000111______________
_________________0100magikh0e0011__1______________
___________11_1100000001___1100000000000000001____
____0000000000000001___________110000000000000____
____00000000000011_________________110000000011___
_____000000001_________________________1000001____
_____100001_______________________________1001____
_______11_________________________________________

  2015                          2026
  BlueNMEA on the phone         gpsdRelay, from F-Droid
  adb port forward over USB     USB tethering (adb still works, below)
  netxml logs                   one .kismet log file (SQLite)
  Giskismet to make KML         kismetdb_to_kml, built in
  android-sdk, ia32-libs        not needed at all
  ncurses UI                    a web UI on port 2501
  WiFi Pineapple notes          dropped; that model is long gone

The biggest change is Kismet itself. Modern Kismet writes everything to a
single kismetdb log and ships its own tools to turn it into KML or a WiGLE
CSV, so the old Giskismet step is gone.

  Laptop      Kali, or any Linux with a current Kismet and gpsd.
  Wi-Fi card  one that does monitor mode. A USB adapter is best, so
              the laptop keeps its own Wi-Fi.
  Phone       Android with GPS, running gpsdRelay.
  Cable       the phone's USB cable, for tethering.

Why tethering over USB, instead of the phone's Wi-Fi hotspot: Kismet puts the
Wi-Fi card into monitor mode, so the laptop can't use that same card to join
your hotspot. The cable gives the phone and laptop their own little network,
keeps your own hotspot out of the capture, and charges the phone while you
drive.

  1. Install gpsdRelay from F-Droid. It sends the phone's GPS to a
     gpsd server over UDP or TCP, and it's maintained (2.2 came out in
     October 2025).
  2. Turn on location and give the phone a minute near a window or outside
     to get a fix.
  3. Let gpsdRelay run in the background. It asks for background location;
     allow it, and turn off battery optimization for it, or the phone will
     put it to sleep mid-drive.
  4. Plug the phone into the laptop and turn on USB tethering (Settings,
     Network, Hotspot and tethering on most phones).

Leave gpsdRelay's destination for a moment; you need the laptop's address on
the tether first.

Install Kismet, gpsd and the gpsd test tools:

  sudo apt update
  sudo apt install kismet gpsd gpsd-clients

Kali's Kismet is current. On other distros, check the version: Kismet's own
install docs warn that some still ship the 2016 release, which predates
the web UI. If the installer asks about installing the capture tools
suid-root, say yes, then add yourself to the kismet group and log out and
back in:

  sudo usermod -aG kismet $USER

Find the laptop's address on the USB tether. It's the new interface that
showed up when you turned tethering on, usually usb0 or enx-something:

  ip -4 addr

Now point gpsdRelay at that address. Pick a port (I use 29470), set it to UDP,
and start relaying.

Stop the gpsd service your distro may have started, so it isn't holding the
port, then run gpsd in the foreground listening for the phone. Use your own
tether address in place of the example:

  sudo systemctl stop gpsd.socket gpsd.service
  sudo gpsd -N -n -D2 udp://192.168.42.10:29470

The udp:// feed tells gpsd to listen for NMEA datagrams on that address and
port. Binding it to the tether address, not 0.0.0.0, keeps it off any other
network the laptop is on.

Check it in a second terminal before you go any further:

  cgps

If cgps shows a latitude and longitude, the phone side is done.

Tell Kismet to use gpsd. Local changes go in the site override file, so an
update doesn't overwrite them:

  echo 'gps=gpsd:host=localhost,port=2947,reconnect=true' | \
    sudo tee -a /etc/kismet/kismet_site.conf

That's Kismet's gpsd GPS type; 2947 is gpsd's own port.

Start Kismet on your monitor-mode card (wlan1 here, use yours) from the
directory where you want the logs:

  mkdir -p ~/wardrive && cd ~/wardrive
  kismet -c wlan1

Open http://localhost:2501 in a browser. The first visit asks you to set a
username and password. Once you're in, the GPS indicator at the top should
show a fix, and networks start filling the device list.

Drive, walk or ride. When you're done, stop Kismet with Ctrl-C. The log is a
single file named like Kismet-20261105-18-30-00-1.kismet, in the directory
you started from.

Kismet's log tools turn the .kismet file into something you can look at. On
Kali they're in the kismet-logtools package:

  kismetdb_to_kml --in your-log.kismet --out wardrive.kml
  kismetdb_to_wiglecsv --in your-log.kismet --out wardrive.csv

  KML      open it in Google Earth or QGIS. Every network shows up as a
           point at the average of where Kismet heard it. That's what
           Giskismet used to do. (kismetdb_to_kml docs)
  CSV      the WiGLE format. Upload it to WiGLE and your drive joins
           the world map of Wi-Fi networks. (wiglecsv docs)

Before you share a map, take your home off it. kismetdb_to_kml's --exclude
option drops every record within a set distance of a location you give it,
so the networks around your house don't end up on a public map with your
name next to them.

  A USB GPS puck      the most reliable option. Plug it in, gpsd finds it,
                      and the same gps=gpsd line works. No phone needed.
  The 2015 way        an app that serves NMEA over TCP, plus adb:
                        adb forward tcp:4352 tcp:4352
                      then Kismet's tcp GPS type reads it with no gpsd:
                        gps=tcp:host=localhost,port=4352
                      It still works if you find an app that serves NMEA;
                      BlueNMEA, the one I used, is gone.
  The phone alone     the WiGLE app on Android wardrives with no laptop
                      at all. It sees less than Kismet with a real card,
                      but it's the easiest start.

  cgps shows no fix      the phone has no fix yet (go outside), gpsdRelay
                         isn't sending (check the address and port), or
                         a firewall on the laptop is dropping the UDP.
  gpsd: address in use   the gpsd service is still running; stop both
                         gpsd.socket and gpsd.service.
  No GPS in Kismet       check the gps= line in kismet_site.conf and
                         that gpsd is still running.
  Card won't open        the suid helpers aren't installed, you aren't
                         in the kismet group yet (log out and back in),
                         or the card doesn't do monitor mode.
  GPS stops mid-drive    Android put gpsdRelay to sleep; turn off battery
                         optimization for it.

Kismet listens; it doesn't connect to anything. Logging the beacons that
networks broadcast is what WiGLE's whole map is built from. Connecting to
networks you don't own, or capturing and cracking traffic without
permission, is a different thing entirely, and it's not what this guide is
for. Rules vary by country, and I'm not a lawyer.

The .kismet log keeps packets by default, and on open networks that can
include other people's traffic. If all you want is the map, keep data frame
contents out of the log with a line in kismet_site.conf:

  dot11_content_filter_default=block

The logging docs cover the rest of the filters. And strip your home
location before you share anything.

Does the 2015 BlueNMEA method still work?
Not as written. BlueNMEA is gone from the app stores, Giskismet reads the old
netxml logs modern Kismet doesn't write by default, and Kali's package names
have changed. The idea is the same, though: a phone app feeds NMEA to gpsd or
Kismet, and the log becomes a map.

What replaced Giskismet for making Kismet maps?
Kismet's own kismetdb_to_kml tool, which turns a .kismet log into KML for
Google Earth or QGIS. kismetdb_to_wiglecsv makes a CSV you can upload to WiGLE.

Why use USB tethering instead of the phone's Wi-Fi hotspot?
Kismet puts the Wi-Fi card into monitor mode, so the laptop can't use that card
to join the phone's hotspot at the same time. USB tethering gives the phone and
laptop their own network over the cable, keeps your hotspot out of the capture,
and charges the phone.

Can Kismet read GPS from a phone without gpsd?
Yes. Kismet's tcp GPS type reads a raw NMEA stream directly, for apps that
serve NMEA over TCP. I use gpsd because it lets me check the fix with cgps and
works with any app that relays to gpsd.

Does Kismet need an internet connection?
No. Kismet, gpsd and the phone's GPS all work with no internet at all. You only
need it later if you upload to WiGLE.

Is wardriving legal?
Passively logging the beacons that networks broadcast is how WiGLE has mapped
Wi-Fi for two decades, but I'm not a lawyer and rules vary by country.
Connecting to networks you don't own, or capturing and cracking traffic without
permission, is where you cross the line.