MQTT

Added: 2023-08

The MQTT source subscribes to a topic on an MQTT broker, and imports the JSON messages published to it as if they had been captured by a Kismet datasource.

This allows Kismet to use data from tools which publish to MQTT, such as rtl_433, without running the tool under Kismet.

MQTT sources are named mqtt, and must include the host, topic, and mapping options:

kismet -c 'mqtt:host=broker.local,topic=rtl_433/+/events,mapping=RTL433,name=rtl433mqtt'

Compiling MQTT support

MQTT support requires libmosquitto, and is enabled by default. If libmosquitto is not available, MQTT support can be disabled by passing --disable-mosquitto to ./configure.

Kismet MQTT support

The MQTT source runs inside the Kismet server, rather than as a separate capture tool, and can not be used as a remote capture.

Every message received on the topic becomes a packet in Kismet, time-stamped as it arrives and tagged with the current GPS location. The mapping option tells Kismet what kind of data the messages contain, and which part of Kismet decodes them:

MappingData
RTL433rtl_433 JSON; sensors become devices, as with the rtl_433 source, and meter records are handled as meters
RTLamrrtlamr JSON, as with the rtlamr source
adsb or RTLadsbADS-B, either raw hex messages in an adsb or adsb_raw_msg field, or rtl_adsb style JSON
antsdr-droneidDJI DroneID records, as with the AntSDR DroneID source
radviewRadview radiation records
radiacodeRadiacode radiation records

The mapping is case-sensitive.

Topic wildcards (+ and #) are supported, and every message received is processed.

Data imported over MQTT is logged in the kismetdb log data table. It is not logged in pcapng, as there are no packets to log.

If the connection to the broker is lost, Kismet raises an alert and the connection is re-established automatically.

MQTT source parameters

Naming and description options

All data sources accept the common naming and description options.

MQTT sources do not have a stable UUID unless one is set with the uuid option; set one if the source should keep the same identity across restarts.

Connection options

host={ hostname or address }

The MQTT broker to connect to. This option is required.

port={ port }

The broker port; by default 1883.

topic={ topic }

The topic to subscribe to. Wildcards are allowed. This option is required.

mapping={ mapping }

The type of data published to the topic; see the table above. This option is required.

identity={ client id }

The MQTT client ID; by default kismet- followed by the source UUID.

Authentication and TLS options

user={ username }

The username to log in to the broker with. A password must also be given, and logins are only allowed over TLS.

password={ password }

The password to log in to the broker with.

tls={ true } / { false }

Connect to the broker with TLS. By default TLS is off, unless one of the TLS file options is set. If no CA is given, the system certificates in /etc/ssl/certs are used.

tls_ca_file={ /path/to/ca.pem }

A CA certificate file used to verify the broker.

tls_ca_dir={ /path/to/ca/dir }

A directory of CA certificates used to verify the broker.

tls_certfile={ /path/to/cert.pem }

A client certificate, for brokers which require certificate authentication.

tls_keyfile={ /path/to/key.pem }

The key for the client certificate. Requires tls_certfile.

tls_keyfile_pw={ password }

The password for an encrypted client key.

Location options

metagps={ name }

Attach a named meta GPS to the source.

Debugging options

debug={ true } / { false }

Show libmosquitto log messages as Kismet debug messages.