lab-sec-1:~ # iw dev phy#0 Interface wlan0 ifindex 5 wdev 0x1 addr 94:e6:f7:17:08:72 type managed txpower 0.00 dBm lab-sec-1:~ # iw wlan0 info Interface wlan0 ifindex 5 wdev 0x1 addr 94:e6:f7:17:08:72 type managed wiphy 0 txpower 0.00 dBm

lab-sec-1:~ # iw phy Wiphy phy0 max # scan SSIDs: 20 max scan IEs length: 422 bytes max # sched scan SSIDs: 20 max # match sets: 11 max # scan plans: 2 max scan plan interval: 65535 max scan plan iterations: 254 Retry short limit: 7 Retry long limit: 4 Coverage class: 0 (up to 0m) Device supports RSN-IBSS. Device supports AP-side u-APSD. Device supports T-DLS. Supported Ciphers: * WEP40 (00-0f-ac:1) * WEP104 (00-0f-ac:5) * TKIP (00-0f-ac:2) * CCMP-128 (00-0f-ac:4) * GCMP-128 (00-0f-ac:8) * GCMP-256 (00-0f-ac:9) * CMAC (00-0f-ac:6) * GMAC-128 (00-0f-ac:11) * GMAC-256 (00-0f-ac:12) Available Antennas: TX 0x3 RX 0x3 Configured Antennas: TX 0x3 RX 0x3 Supported interface modes: * IBSS * managed * AP * AP/VLAN * monitor * P2P-client * P2P-GO * P2P-device

Band 1: Capabilities: 0x19ef RX LDPC HT20/HT40 SM Power Save disabled RX HT20 SGI RX HT40 SGI TX STBC RX STBC 1-stream Max AMSDU length: 7935 bytes DSSS/CCK HT40 Maximum RX AMPDU length 65535 bytes (exponent: 0x003) Minimum RX AMPDU time spacing: 4 usec (0x05) HT Max RX data rate: 300 Mbps HT TX/RX MCS rate indexes supported: 0-15 Bitrates (non-HT): * 1.0 Mbps * 2.0 Mbps (short preamble supported) * 5.5 Mbps (short preamble supported) * 11.0 Mbps (short preamble supported) * 6.0 Mbps * 9.0 Mbps * 12.0 Mbps * 18.0 Mbps * 24.0 Mbps * 36.0 Mbps * 48.0 Mbps * 54.0 Mbps Frequencies: * 2412 MHz [1] (22.0 dBm) * 2417 MHz [2] (22.0 dBm) * 2422 MHz [3] (22.0 dBm) * 2427 MHz [4] (22.0 dBm) * 2432 MHz [5] (22.0 dBm) * 2437 MHz [6] (22.0 dBm) * 2442 MHz [7] (22.0 dBm) * 2447 MHz [8] (22.0 dBm) * 2452 MHz [9] (22.0 dBm) * 2457 MHz [10] (22.0 dBm) * 2462 MHz [11] (22.0 dBm) * 2467 MHz [12] (22.0 dBm) * 2472 MHz [13] (22.0 dBm) * 2484 MHz [14] (22.0 dBm)

Band 2: Capabilities: 0x19ef RX LDPC HT20/HT40 SM Power Save disabled RX HT20 SGI RX HT40 SGI TX STBC RX STBC 1-stream Max AMSDU length: 7935 bytes DSSS/CCK HT40 Maximum RX AMPDU length 65535 bytes (exponent: 0x003) Minimum RX AMPDU time spacing: 4 usec (0x05) HT Max RX data rate: 300 Mbps HT TX/RX MCS rate indexes supported: 0-15 VHT Capabilities (0x039071f6): Max MPDU length: 11454 Supported Channel Width: 160 MHz RX LDPC short GI (80 MHz) short GI (160/80+80 MHz) TX STBC SU Beamformee MU Beamformee VHT RX MCS set: 1 streams: MCS 0-9 2 streams: MCS 0-9 3 streams: not supported 4 streams: not supported 5 streams: not supported 6 streams: not supported 7 streams: not supported 8 streams: not supported VHT RX highest supported: 0 Mbps VHT TX MCS set: 1 streams: MCS 0-9 2 streams: MCS 0-9 3 streams: not supported 4 streams: not supported 5 streams: not supported 6 streams: not supported 7 streams: not supported 8 streams: not supported VHT TX highest supported: 0 Mbps Bitrates (non-HT): * 6.0 Mbps * 9.0 Mbps * 12.0 Mbps * 18.0 Mbps * 24.0 Mbps * 36.0 Mbps * 48.0 Mbps * 54.0 Mbps Frequencies: * 5180 MHz [36] (22.0 dBm) * 5200 MHz [40] (22.0 dBm) * 5220 MHz [44] (22.0 dBm) * 5240 MHz [48] (22.0 dBm) * 5260 MHz [52] (22.0 dBm) * 5280 MHz [56] (22.0 dBm) * 5300 MHz [60] (22.0 dBm) * 5320 MHz [64] (22.0 dBm) * 5340 MHz [68] (22.0 dBm) * 5360 MHz [72] (22.0 dBm) * 5380 MHz [76] (22.0 dBm) * 5400 MHz [80] (22.0 dBm) * 5420 MHz [84] (22.0 dBm) * 5440 MHz [88] (22.0 dBm) * 5460 MHz [92] (22.0 dBm) * 5480 MHz [96] (22.0 dBm) * 5500 MHz [100] (22.0 dBm) * 5520 MHz [104] (22.0 dBm) * 5540 MHz [108] (22.0 dBm) * 5560 MHz [112] (22.0 dBm) * 5580 MHz [116] (22.0 dBm) * 5600 MHz [120] (22.0 dBm) * 5620 MHz [124] (22.0 dBm) * 5640 MHz [128] (22.0 dBm) * 5660 MHz [132] (22.0 dBm) * 5680 MHz [136] (22.0 dBm) * 5700 MHz [140] (22.0 dBm) * 5720 MHz [144] (22.0 dBm) * 5745 MHz [149] (22.0 dBm) * 5765 MHz [153] (22.0 dBm) * 5785 MHz [157] (22.0 dBm) * 5805 MHz [161] (22.0 dBm) * 5825 MHz [165] (22.0 dBm) * 5845 MHz [169] (22.0 dBm) * 5865 MHz [173] (22.0 dBm) * 5885 MHz [177] (22.0 dBm) * 5905 MHz [181] (22.0 dBm)

Supported commands: * new_interface * set_interface * new_key * start_ap * new_station * new_mpath * set_mesh_config * set_bss * authenticate * associate * deauthenticate * disassociate * join_ibss * join_mesh * remain_on_channel * set_tx_bitrate_mask * frame * frame_wait_cancel * set_wiphy_netns * set_channel * set_wds_peer * tdls_mgmt * tdls_oper * start_sched_scan * probe_client * set_noack_map * register_beacons * start_p2p_device * set_mcast_rate * connect * disconnect * channel_switch * set_qos_map * add_tx_ts * Unknown command (121) Supported TX frame types: * IBSS: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0 * managed: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0 * AP: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0 * AP/VLAN: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0 * mesh point: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0 * P2P-client: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0 * P2P-GO: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0 * P2P-device: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0 Supported RX frame types: * IBSS: 0x40 0xb0 0xc0 0xd0 * managed: 0x40 0xb0 0xd0 * AP: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0 * AP/VLAN: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0 * mesh point: 0xb0 0xc0 0xd0 * P2P-client: 0x40 0xd0 * P2P-GO: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0 * P2P-device: 0x40 0xd0 WoWLAN support: * wake up on disconnect * wake up on magic packet * wake up on pattern match, up to 20 patterns of 16-128 bytes, maximum packet offset 0 bytes * can do GTK rekeying * wake up on GTK rekey failure * wake up on EAP identity request * wake up on 4-way handshake * wake up on rfkill release * wake up on network detection, up to 11 match sets software interface modes (can always be added): * AP/VLAN * monitor valid interface combinations: * #{ managed } <= 1, #{ AP, P2P-client, P2P-GO } <= 1, #{ P2P-device } <= 1, total <= 3, #channels <= 2 HT Capability overrides: * MCS: ff ff ff ff ff ff ff ff ff ff * maximum A-MSDU length * supported channel width * short GI for 40 MHz * max A-MPDU length exponent * min MPDU start spacing Device supports TX status socket option. Device supports HT-IBSS. Device supports SAE with AUTHENTICATE command Device supports low priority scan. Device supports scan flush. Device supports per-vif TX power setting P2P GO supports CT window setting P2P GO supports opportunistic powersave setting Driver supports full state transitions for AP/GO clients Driver supports a userspace MPM Driver/device bandwidth changes during BSS lifetime (AP/GO mode) Device adds DS IE to probe requests Device can update TPC Report IE Device supports static SMPS Device supports dynamic SMPS Device supports WMM-AC admission (TSPECs) Device supports configuring vdev MAC-addr on create. Device supports VHT-IBSS.

lab-sec-1:~ # ip link set wlan0 down lab-sec-1:~ # iw wlan0 set type monitor lab-sec-1:~ # ip link set wlan0 up lab-sec-1:~ # iw wlan0 info Interface wlan0 ifindex 5 wdev 0x1 addr 94:e6:f7:17:0f:b1 type monitor wiphy 0 channel 1 (2412 MHz), width: 20 MHz (no HT), center1: 2412 MHz txpower 0.00 dBm lab-sec-1:~ # iw wlan0 set channel 1 HT40+ lab-sec-1:~ # iw wlan0 info Interface wlan0 ifindex 5 wdev 0x1 addr 94:e6:f7:17:0f:b1 type monitor wiphy 0 channel 1 (2412 MHz), width: 40 MHz, center1: 2422 MHz txpower 0.00 dBm lab-sec-1:~ # iw dev wlan0 set freq 5180 160 5250 lab-sec-1:~ # iw wlan0 info Interface wlan0 ifindex 5 wdev 0x1 addr 94:e6:f7:17:0f:b1 type monitor wiphy 0 channel 36 (5180 MHz), width: 160 MHz, center1: 5250 MHz txpower 0.00 dBm

lab-sec-1:~ # iw wlan0 scan (…) BSS 94:9b:2c:09:86:10(on wlan0) last seen: 1707.440s [boottime] TSF: 7310209378470 usec (84d, 14:36:49) freq: 5180 beacon interval: 100 TUs capability: ESS Privacy SpectrumMgmt ShortSlotTime RadioMeasure (0x1511) signal: -76.00 dBm last seen: 0 ms ago Information elements from Probe Response frame: SSID: eduroam Supported rates: 6.0* 9.0 12.0* 18.0 24.0* 36.0 48.0 54.0 DS Parameter set: channel 36 Country: PL Environment: Indoor only Channels [36 - 64] @ 23 dBm Channels [100 - 140] @ 30 dBm BSS Load: * station count: 9 * channel utilisation: 15/255 * available admission capacity: 31250 [*32us] TPC report: TX power: 16 dBm Power constraint: 0 dB HT capabilities: Capabilities: 0x86f RX LDPC HT20/HT40 SM Power Save disabled RX HT20 SGI RX HT40 SGI No RX STBC Max AMSDU length: 7935 bytes No DSSS/CCK HT40 Maximum RX AMPDU length 65535 bytes (exponent: 0x003) Minimum RX AMPDU time spacing: No restriction (0x00) HT RX MCS rate indexes supported: 0-15 HT TX MCS rate indexes are undefined HT operation: * primary channel: 36 * secondary channel offset: above * STA channel width: any * RIFS: 0 * HT protection: no * non-GF present: 1 * OBSS non-GF present: 0 * dual beacon: 0 * dual CTS protection: 0 * STBC beacon: 0 * L-SIG TXOP Prot: 0 * PCO active: 0 * PCO phase: 0 Overlapping BSS scan params: * passive dwell: 20 TUs * active dwell: 10 TUs * channel width trigger scan interval: 300 s * scan passive total per channel: 200 TUs * scan active total per channel: 20 TUs * BSS width channel transition delay factor: 5 * OBSS Scan Activity Threshold: 0.25 % Extended capabilities: HT Information Exchange Supported, Extended Channel Switching, Proxy ARP Service, SSID List, 6 VHT capabilities: VHT Capabilities (0x33895832): Max MPDU length: 11454 Supported Channel Width: neither 160 nor 80+80 RX LDPC short GI (80 MHz) SU Beamformer SU Beamformee MU Beamformer RX antenna pattern consistency TX antenna pattern consistency VHT RX MCS set: 1 streams: MCS 0-9 2 streams: MCS 0-9 3 streams: not supported 4 streams: not supported 5 streams: not supported 6 streams: not supported 7 streams: not supported 8 streams: not supported VHT RX highest supported: 0 Mbps VHT TX MCS set: 1 streams: MCS 0-9 2 streams: MCS 0-9 3 streams: not supported 4 streams: not supported 5 streams: not supported 6 streams: not supported 7 streams: not supported 8 streams: not supported VHT TX highest supported: 0 Mbps VHT operation: * channel width: 0 (20 or 40 MHz) * center freq segment 1: 0 * center freq segment 2: 0 * VHT basic MCS set: 0xfffc WMM: * Parameter version 1 * BE: CW 15-1023, AIFSN 3 * BK: CW 15-1023, AIFSN 7 * VI: CW 7-15, AIFSN 2, TXOP 3008 usec * VO: CW 3-7, AIFSN 2, TXOP 1504 usec RSN: * Version: 1 * Group cipher: CCMP * Pairwise ciphers: CCMP * Authentication suites: IEEE 802.1X * Capabilities: 1-PTKSA-RC 1-GTKSA-RC MFP-capable (0x0080) BSS 94:9b:2c:0a:78:f0(on wlan0) last seen: 1887.729s [boottime] TSF: 8138126260614 usec (94d, 04:35:26) freq: 5220 beacon interval: 100 TUs capability: ESS Privacy SpectrumMgmt ShortSlotTime RadioMeasure (0x1511) signal: -85.00 dBm last seen: 12 ms ago Information elements from Probe Response frame: SSID: eduroam (…)

lab-sec-1:~ # iw wlan0 set type ibss lab-sec-1:~ # ip l set dev wlan0 up lab-sec-1:~ # iw wlan0 info Interface wlan0 ifindex 5 wdev 0x1 addr 94:e6:f7:17:0f:b1 type IBSS wiphy 0 txpower 0.00 dBm lab-sec-1:~ # iw wlan0 ibss join ExampleIBSS 2472 HT40- lab-sec-1:~ # iw wlan0 link Not connected. lab-sec-1:~ # iw wlan0 link Joined IBSS 4a:65:c8:86:c3:6a (on wlan0) SSID: ExampleIBSS freq: 2472 lab-sec-1:~ # iw wlan0 info Interface wlan0 ifindex 5 wdev 0x1 addr 94:e6:f7:17:0f:b1 ssid ExampleIBSS type IBSS wiphy 0 channel 13 (2472 MHz), width: 40 MHz, center1: 2462 MHz txpower 22.00 dBm lab-sec-2:~ # iw wlan0 scan BSS 4a:65:c8:86:c3:6a(on wlan0) last seen: 2195.057s [boottime] TSF: 33016826 usec (0d, 00:00:33) freq: 2472 beacon interval: 100 TUs capability: IBSS (0x0002) signal: -47.00 dBm last seen: 0 ms ago SSID: ExampleIBSS Supported rates: 1.0* 2.0* 5.5* 11.0* 6.0 9.0 12.0 18.0 DS Parameter set: channel 13 IBSS ATIM window: 0 TUs Extended supported rates: 24.0 36.0 48.0 54.0 HT capabilities: Capabilities: 0x19ef RX LDPC HT20/HT40 SM Power Save disabled RX HT20 SGI RX HT40 SGI TX STBC RX STBC 1-stream Max AMSDU length: 7935 bytes DSSS/CCK HT40 Maximum RX AMPDU length 65535 bytes (exponent: 0x003) Minimum RX AMPDU time spacing: 4 usec (0x05) HT Max RX data rate: 300 Mbps HT TX/RX MCS rate indexes supported: 0-15 HT operation: * primary channel: 13 * secondary channel offset: below * STA channel width: any * RIFS: 0 * HT protection: no * non-GF present: 0 * OBSS non-GF present: 0 * dual beacon: 0 * dual CTS protection: 0 * STBC beacon: 0 * L-SIG TXOP Prot: 0 * PCO active: 0 * PCO phase: 0 WMM: information: 01 00