{"action":"created","issue":{"url":"https://api.github.com/repos/greearb/ath10k-ct/issues/29","repository_url":"https://api.github.com/repos/greearb/ath10k-ct","labels_url":"https://api.github.com/repos/greearb/ath10k-ct/issues/29/labels{/name}","comments_url":"https://api.github.com/repos/greearb/ath10k-ct/issues/29/comments","events_url":"https://api.github.com/repos/greearb/ath10k-ct/issues/29/events","html_url":"https://github.com/greearb/ath10k-ct/issues/29","id":347821906,"node_id":"MDU6SXNzdWUzNDc4MjE5MDY=","number":29,"title":"Problem with scanning hidden SSID","user":{"login":"jhaakana","id":16662378,"node_id":"MDQ6VXNlcjE2NjYyMzc4","avatar_url":"https://avatars0.githubusercontent.com/u/16662378?v=4","gravatar_id":"","url":"https://api.github.com/users/jhaakana","html_url":"https://github.com/jhaakana","followers_url":"https://api.github.com/users/jhaakana/followers","following_url":"https://api.github.com/users/jhaakana/following{/other_user}","gists_url":"https://api.github.com/users/jhaakana/gists{/gist_id}","starred_url":"https://api.github.com/users/jhaakana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhaakana/subscriptions","organizations_url":"https://api.github.com/users/jhaakana/orgs","repos_url":"https://api.github.com/users/jhaakana/repos","events_url":"https://api.github.com/users/jhaakana/events{/privacy}","received_events_url":"https://api.github.com/users/jhaakana/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2018-08-06T08:12:48Z","updated_at":"2018-08-10T11:02:52Z","closed_at":null,"author_association":"NONE","body":"WLAN module: WLE1216V2-20\r\nFirmware: 10.4-ct-9984-fW-011-da1d791\r\nboard-2.bin: stock board-2.bin or board-2-ct.bin (from https://www.candelatech.com/downloads/ath10k-9984-10-4/board-2-ct.bin)\r\nOS: LEDE latest, mvebu/cortexa9, arm_cortex-a9_vfpv3\r\nKernel: 4.14.51\r\nDriver: ath10k-ct 4.13 (ath10k-ct-2018-05-30-127f9818)\r\n\r\n**Problem description:**\r\n\r\nath10k-ct with CT firmware fails to scan a hidden SSID, when scanning on single channel. ath10k-ct driver with stock firmware does not have this problem.\r\n\r\n**Setup:**\r\n\r\nInterface ath0 in managed mode, interface ath1 in monitor mode. Cisco standalone AP, two SSIDs, \"7signal\" is beaconing, \"7fast\" is hidden. Channel 13 (2472MHz).\r\n\r\n**Test case:**\r\n\r\n```\r\n# ifconfig ath0 down\r\n# iw dev ath1 set channel 13\r\n# ifconfig ath0 up\r\n# iw dev ath0 scan freq 2472 ssid 7fast\r\n# iw dev ath0 scan freq 2472 ssid 7fast\r\n# iw dev ath0 scan freq 2472 ssid 7fast\r\n# iw dev ath0 scan freq 2472 ssid 7fast\r\nBSS 58:bc:27:5d:8b:b0(on ath0)\r\n        TSF: 9491880875384 usec (109d, 20:38:00)\r\n        freq: 2472\r\n        beacon interval: 323 TUs\r\n        capability: ESS (0x0431)\r\n        signal: -56.00 dBm\r\n        last seen: 0 ms ago\r\n        Information elements from Probe Response frame:\r\n        SSID: 7signal\r\n        HT capabilities:\r\n                Capabilities: 0x186e\r\n                        HT20/HT40\r\n                        SM Power Save disabled\r\n                        RX HT20 SGI\r\n                        RX HT40 SGI\r\n                        No RX STBC\r\n                        Max AMSDU length: 7935 bytes\r\n                        DSSS/CCK HT40\r\n                Maximum RX AMPDU length 65535 bytes (exponent: 0x003)\r\n                Minimum RX AMPDU time spacing: 8 usec (0x06)\r\n                HT RX MCS rate indexes supported: 0-15\r\n                HT TX MCS rate indexes are undefined\r\n        RSN:     * Version: 1\r\n                 * Group cipher: CCMP\r\n                 * Pairwise ciphers: CCMP\r\n                 * Authentication suites: PSK\r\n                 * Capabilities: 4-PTKSA-RC 4-GTKSA-RC (0x0028)\r\n        HT operation:\r\n                 * primary channel: 13\r\n                 * secondary channel offset: no secondary\r\n                 * STA channel width: 20 MHz\r\n```\r\ntcpdump on ath1 shows only a beacon (not probe responses)\r\n\r\n`10:52:21.277663 470035344us tsft 1.0 Mb/s 2472 MHz 11b -58dBm signal -69dBm signal antenna 0 -72dBm signal antenna 1 -59dBm signal antenna 2 -66dBm signal antenna 3 Beacon (7signal) [1.0* 2.0* 5.5* 6.0* 9.0* 11.0* 12.0* 18.0* Mbit] ESS CH: 13, PRIVACY`\r\n\r\nWith stock FW:\r\n\r\n```\r\n# ifconfig ath0 down\r\n# iw dev ath1 set channel 13\r\n# ifconfig ath0 up\r\n# iw dev ath0 scan freq 2472 ssid 7fast\r\nBSS 58:bc:27:5d:8b:b0(on ath0)\r\n        TSF: 9492192296501 usec (109d, 20:43:12)\r\n        freq: 2472\r\n        beacon interval: 323 TUs\r\n        capability: ESS (0x0431)\r\n        signal: -56.00 dBm\r\n        last seen: 50 ms ago\r\n        SSID: 7fast\r\n        HT capabilities:\r\n                Capabilities: 0x186e\r\n                        HT20/HT40\r\n                        SM Power Save disabled\r\n                        RX HT20 SGI\r\n                        RX HT40 SGI\r\n                        No RX STBC\r\n                        Max AMSDU length: 7935 bytes\r\n                        DSSS/CCK HT40\r\n                Maximum RX AMPDU length 65535 bytes (exponent: 0x003)\r\n                Minimum RX AMPDU time spacing: 8 usec (0x06)\r\n                HT RX MCS rate indexes supported: 0-15\r\n                HT TX MCS rate indexes are undefined\r\n        RSN:     * Version: 1\r\n                 * Group cipher: CCMP\r\n                 * Pairwise ciphers: CCMP\r\n                 * Authentication suites: IEEE 802.1X\r\n                 * Capabilities: 4-PTKSA-RC 4-GTKSA-RC (0x0028)\r\n        HT operation:\r\n                 * primary channel: 13\r\n                 * secondary channel offset: no secondary\r\n                 * STA channel width: 20 MHz\r\n```\r\n\r\ntcpdump on ath1 shows beacons and probe responses from the hidden SSID:\r\n\r\n```\r\n10:57:19.108469 136384411us tsft 1.0 Mb/s 2472 MHz 11b -56dBm signal -70dBm signal antenna 0 -72dBm signal antenna 1 -57dBm signal antenna 2 -64dBm signal antenna 3 Probe Response (7fast) [1.0* 2.0* 5.5* 6.0* 9.0* 11.0* 12.0* 18.0* Mbit] CH: 13, PRIVACY\r\n10:57:22.699111 139975661us tsft bad-fcs 48.0 Mb/s 2472 MHz 11g -86dBm signal -93dBm signal antenna 0 -89dBm signal antenna 1 -93dBm signal antenna 2 -96dBm signal antenna 3 unknown 802.11 frame type (3)\r\n10:57:29.943393 147216231us tsft 1.0 Mb/s 2472 MHz 11b -57dBm signal -67dBm signal antenna 0 -64dBm signal antenna 1 -60dBm signal antenna 2 -68dBm signal antenna 3 Probe Response (7fast) [1.0* 2.0* 5.5* 6.0* 9.0* 11.0* 12.0* 18.0* Mbit] CH: 13, PRIVACY\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/greearb/ath10k-ct/issues/comments/412050794","html_url":"https://github.com/greearb/ath10k-ct/issues/29#issuecomment-412050794","issue_url":"https://api.github.com/repos/greearb/ath10k-ct/issues/29","id":412050794,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMjA1MDc5NA==","user":{"login":"jhaakana","id":16662378,"node_id":"MDQ6VXNlcjE2NjYyMzc4","avatar_url":"https://avatars0.githubusercontent.com/u/16662378?v=4","gravatar_id":"","url":"https://api.github.com/users/jhaakana","html_url":"https://github.com/jhaakana","followers_url":"https://api.github.com/users/jhaakana/followers","following_url":"https://api.github.com/users/jhaakana/following{/other_user}","gists_url":"https://api.github.com/users/jhaakana/gists{/gist_id}","starred_url":"https://api.github.com/users/jhaakana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhaakana/subscriptions","organizations_url":"https://api.github.com/users/jhaakana/orgs","repos_url":"https://api.github.com/users/jhaakana/repos","events_url":"https://api.github.com/users/jhaakana/events{/privacy}","received_events_url":"https://api.github.com/users/jhaakana/received_events","type":"User","site_admin":false},"created_at":"2018-08-10T11:02:52Z","updated_at":"2018-08-10T11:02:52Z","author_association":"NONE","body":"You are right - probe requests are not going out. I ran the scan command 8 times until it finally sent out a probe request:\r\n\r\n```\r\n...\r\n# iw dev ath2 scan freq 5540 ssid 7fast | grep 7fast\r\n# iw dev ath2 scan freq 5540 ssid 7fast | grep 7fast\r\n# iw dev ath2 scan freq 5540 ssid 7fast | grep 7fast\r\n# iw dev ath2 scan freq 5540 ssid 7fast | grep 7fast\r\n        SSID: 7fast\r\n\r\n```\r\nOn external device that executed tcpdump with correct filter:\r\n\r\n```\r\n# tcpdump -i ath1 wlan addr1 04:F0:21:39:12:AB or wlan addr2 04:F0:21:39:12:AB or wlan addr3 04:F0:21:39:12:AB\r\ntcpdump: WARNING: ath1: no IPv4 address assigned\r\ntcpdump: verbose output suppressed, use -v or -vv for full protocol decode\r\nlistening on ath1, link-type IEEE802_11_RADIO (802.11 plus radiotap header), capture size 65535 bytes\r\n\r\n13:53:09.372492 6.0 Mb/s 5540 MHz 11a -19dB signal antenna 0 Probe Request (7fast) [6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit]\r\n13:53:09.372887 6.0 Mb/s 5540 MHz 11a -33dB signal antenna 0 Probe Response (7fast) [6.0* 9.0 18.0 24.0* 36.0 48.0 54.0 Mbit], PRIVACY\r\n\r\n\r\n```\r\n\r\nSo it looks like probe requests are not sent out reliably. This seems to with active scan, even without providing specific SSID. I cannot see probe requests with wildcard SSID on another device tcpdump. The FW version I used for this test was 10.4b-ct-9984-fH-011-32616f6."}}
{"actor":{"display_login":"jhaakana"}}