Certified Ethical Hacker (CEH) Practice Question

Kismet operates in a completely passive mode, only listening to 802.11 traffic without transmitting frames, so it is not easily detected by WIDS or by the target networks. It can correlate beacon, probe-response, and data frames to reveal ("decloak") hidden SSIDs and records GPS information when used with a GPS receiver, producing maps for wardriving or site surveys. NetStumbler relies on active probe requests that generate traffic and cannot reliably capture hidden SSIDs. Reaver is designed for active WPS PIN brute-forcing and does not perform broad passive discovery or mapping. The aireplay-ng component of Aircrack-ng requires frame injection and is used for attacks such as de-authentication, not for silent mapping with GPS correlation. Therefore, Kismet is the most appropriate choice.