ESP32-C5 Kismet firmware

Flash an ESP32-C5 board from this page and it becomes a capture source for Kismet on three radios: Wi-Fi on 2.4 and 5 GHz, IEEE 802.15.4 for Zigbee and Thread, and Bluetooth LE advertising. A board listens with one radio at a time, and Kismet's source definition picks it.

Install from the browser

Plug the board in by its native USB port, then press Install. Nothing to install on your computer.

This browser cannot talk to USB serial devices: it has no Web Serial. Open this page in Chrome or Edge 89 or newer on a computer, or flash the board with esptool, as below. The browser allows serial access only on an HTTPS page. Open https://oshri-almog.github.io/esp32c5-kismet-wifi-interface/.

The Install button needs JavaScript and the ESP Web Tools module from unpkg.com. If no button appears, flash the board with esptool, as below.

Needs a browser with Web Serial: Chrome or Edge 89 or newer on Windows, macOS or Linux, or another Chromium-based browser that has it, such as Opera. Safari has no Web Serial. Firefox added Web Serial in version 151, after you allow a site permission add-on it offers, and recent Chrome on Android has it too; this page has not been tried in either.

Installs version v0.1.0-3-gc5d3534, built from this project's source by GitHub Actions (details).

Before you press Install

Use the native USB port. That is the chip's own USB-Serial-JTAG port, USB ID 303a:1001. On a board with two USB connectors, use the one for native USB, not the one marked UART, which goes through a USB-to-serial chip and carries only the firmware's log. A board with one USB-C connector, such as the Seeed Studio XIAO ESP32C5, uses it for native USB. Use a data cable: a charge-only cable gives no port at all.
Free the port. Stop Kismet, the capture helpers, any Docker container that uses the board, and serial terminals. Only one program can have the port open.
A board last used for Zigbee or Thread (802.15.4): put it on Wi-Fi first. Run a Wi-Fi source on it until Kismet says it is capturing, then stop Kismet. A board flashed while it is on 802.15.4 can come up deaf to Wi-Fi; see below.
To keep what is on the board now, back it up first. This page cannot read the board. esptool can: Back up the board first.
On Linux, your user needs access to the port, which on Debian, Ubuntu and Raspberry Pi OS means the dialout group: sudo usermod -aG dialout $USER, then log out and back in.

Steps

Plug the board into the computer by its native USB port.
Press Install above.
The browser lists serial ports. Choose the board's port and press Connect. It is a COM port on Windows, ttyACM on Linux and cu.usbmodem on macOS. If you are not sure which one it is, unplug the board and watch which entry goes away.
In the window that opens, choose Install ESP32-C5 Kismet firmware.
Erase device asks whether to erase the whole flash first. Either way works, and either way the board starts on Wi-Fi, because the image overwrites the place where the board keeps its last radio. Erasing takes longer and leaves nothing of the old contents; without it, flash beyond the firmware is left as it was, unused. Press Next.
Confirm with Install.
Wait until the window says Installation complete! Do not unplug the board while the progress bar runs. The board is then reset and starts the new firmware.
Press Next, then close the window with its ×. While it is open, the browser keeps the port, and Kismet or a helper cannot open it.

After the install

The board boots in Wi-Fi mode and starts streaming over its USB port at once, ready for a Kismet source to open it. You do not set the radio here: Kismet's sources do. A Wi-Fi, Zigbee or Bluetooth LE source tells the board which radio to use, and the board reboots into it in about half a second if it was on another one. It remembers its last radio across resets and power cycles.

The board's source never starts capturing. Some boards stay in download mode after flashing and do not run the new firmware. Unplug the board and plug it back in, or press its BOOT button once.
"Logs & Console" shows a stream of random characters. That is normal. The native USB port carries only the binary capture stream (a PCAP stream), not text; the firmware's log goes to the UART pins at 115200 baud. Close the console when you are done.
"Failed to initialize" while installing: unplug the board, hold its BOOT button while you plug it back in, let go, and try again. If the browser cannot open the port at all, another program has it, or on Linux your user is not in dialout.

To check that the board captures, follow Check the result.

Known issue: a board that ran Zigbee can come up deaf to Wi-Fi

A board that was on 802.15.4 (Zigbee or Thread) when it was flashed can come up with a Wi-Fi radio that hears nothing. Its Wi-Fi source says it is capturing, but the packet count stays at 0 and no error follows. In the project's tests this happened both times a board was flashed while it was on 802.15.4, and not when it was flashed from Wi-Fi. An esptool reset did not cure it; the firmware's notes say unplugging the board does, which was not tried.

To avoid it, run a Wi-Fi source on the board until it says it is capturing before you flash it.
To cure it, switch the board to Bluetooth LE and back: run a BTLE source on it (such as esp32c5btle-ttyACM0) until it says it is capturing, close it, then open the Wi-Fi source again.

Troubleshooting has the details.

Next steps

The board is half of it. Kismet needs this project's esp32c5 source:

Choosing a Setup: where Kismet runs, and how the boards reach it.
Install pages: Raspberry Pi, Linux, Docker, Windows, WSL2, macOS and BSD.
Check the result: make sure the board answers and captures.
Guide: First Capture: a first capture with the web UI.
Hardware: boards, antennas, hubs, and what each radio can capture.

Nothing is uploaded

Your browser downloads the firmware image from this site and writes it to the board over USB. Nothing from the board or your computer is sent anywhere, and the page keeps no data.

Without the browser: esptool

This page's image is esp32c5-kismet-merged.bin, with its SHA-256 below. Releases from v0.1.0 on carry the same kind of image, built from their tag, as esp32c5-kismet-<version>-merged.bin with its SHA-256; see the releases. A release's image is a separate build of the same firmware, so its SHA-256 differs from this page's even for the same version: check it against the release's own .sha256 file. The image holds the bootloader, the partition table and the application, and is flashed at offset 0x0. With Python, in the folder where you saved the file (on Linux the port is /dev/ttyACM0 or similar):

python -m pip install esptool
python -m esptool --chip esp32c5 -p COM14 -b 460800 write_flash 0x0 esp32c5-kismet-merged.bin

Flashing the Firmware covers esptool, backups, flashing several boards, and building the firmware yourself with ESP-IDF 5.5.

This build

Version: v0.1.0-3-gc5d3534, as the board's log reports it (App version)
Commit: c5d3534
Image: firmware/esp32c5-kismet-merged.bin, 1,148,592 bytes, flashed at 0x0
SHA-256: 09d049690122ed868e1cceb1e10d8b51b1afcb5b64334624a90598ac7e038b56
Built with: ESP-IDF v5.5.5, target esp32c5