linksys router incorrectly showing as WEP?

linksys router incorrectly showing as WEP?

[Bryce Johnson]

Hi All,
We have some embedded linux devices with TI cc3301 chipset.  At one of
our labs, the router (linksys MR6350) according to IWD will show up as
wep security then go back to psk.

Odd thing is this router doesn't even support WEP - the only security
option it has listed in wpa2-personal or open.

We have like 20 devices in the lab and it appears to be happening to
some or all of them. I'm needing to remote desktop over to a computer
that has a serial connection... so slightly difficult to get logs.

I want to just blame the router and have them replace it, but I
figured I'd check if there is any other issue here as well.  I have
full IWD debug logs saved, but here is a snippet.

2025-05-12 16:15:53.428737870  Wireless daemon version 3.4
<SNIP>
2025-05-12 16:15:55.791609235  src/station.c:station_print_scan_bss()
Processing BSS 'd8:ec:5e:99:0e:6c' with SSID: Revelotest4, freq: 2427,
rank: 492, strength: -4600, data_rate: 72.2
2025-05-12 16:15:55.791622150  src/station.c:station_add_seen_bss()
Added new Network "Revelotest4" security wep
<SNIP>
2025-05-12 16:22:15.714231348  src/station.c:station_print_scan_bss()
Processing BSS 'd8:ec:5e:99:0e:6c' with SSID: Revelotest4, freq: 2427,
rank: 492, strength: -4700, data_rate: 72.2
2025-05-12 16:22:15.714244273  src/station.c:station_add_seen_bss()
Added new Network "Revelotest4" security psk
<SNIP>
2025-05-12 16:22:15.717638513  src/station.c:process_network() No
remaining BSSs for SSID: Revelotest4 -- Removing network

Then killing IWD and restarting

2025-05-12 16:23:24.015924492  src/station.c:station_print_scan_bss()
Processing BSS 'd8:ec:5e:99:0e:6c' with SSID: Revelotest4, freq: 2427,
rank: 492, strength: -4500, data_rate: 72.2
2025-05-12 16:23:24.015937250  src/station.c:station_add_seen_bss()
Added new Network "Revelotest4" security psk


On another 2 device: (2025-05-08 date is incorrect it was before it
got good time).  They in total had been up 30 minutes or so.

device 2:
2025-05-08 17:00:09.699817830  src/station.c:station_add_seen_bss()
Added new Network "Revelotest4" security wep
2025-05-12 16:33:47.901451708  src/station.c:station_add_seen_bss()
Added new Network "Revelotest4" security psk

device 3:
2025-05-08 17:00:06.777723005  src/station.c:station_add_seen_bss()
Added new Network "Revelotest4" security wep
2025-05-12 16:33:49.145627332  src/station.c:station_add_seen_bss()
Added new Network "Revelotest4" security psk

That 2 devices do it at the same time - makes it seem like the router
is doing some funky stuff.

Thank
Bryce

Re: linksys router incorrectly showing as WEP?

[James Prestwood]

Hi Bryce,

On 5/12/25 10:28 AM, Bryce Johnson wrote:
> Hi All,
> We have some embedded linux devices with TI cc3301 chipset.  At one of
> our labs, the router (linksys MR6350) according to IWD will show up as
> wep security then go back to psk.
>
> Odd thing is this router doesn't even support WEP - the only security
> option it has listed in wpa2-personal or open.
>
> We have like 20 devices in the lab and it appears to be happening to
> some or all of them. I'm needing to remote desktop over to a computer
> that has a serial connection... so slightly difficult to get logs.
>
> I want to just blame the router and have them replace it, but I
> figured I'd check if there is any other issue here as well.  I have
> full IWD debug logs saved, but here is a snippet.
>
> 2025-05-12 16:15:53.428737870  Wireless daemon version 3.4
> <SNIP>
> 2025-05-12 16:15:55.791609235  src/station.c:station_print_scan_bss()
> Processing BSS 'd8:ec:5e:99:0e:6c' with SSID: Revelotest4, freq: 2427,
> rank: 492, strength: -4600, data_rate: 72.2
> 2025-05-12 16:15:55.791622150  src/station.c:station_add_seen_bss()
> Added new Network "Revelotest4" security wep
> <SNIP>
> 2025-05-12 16:22:15.714231348  src/station.c:station_print_scan_bss()
> Processing BSS 'd8:ec:5e:99:0e:6c' with SSID: Revelotest4, freq: 2427,
> rank: 492, strength: -4700, data_rate: 72.2
> 2025-05-12 16:22:15.714244273  src/station.c:station_add_seen_bss()
> Added new Network "Revelotest4" security psk
> <SNIP>
> 2025-05-12 16:22:15.717638513  src/station.c:process_network() No
> remaining BSSs for SSID: Revelotest4 -- Removing network
>
> Then killing IWD and restarting
>
> 2025-05-12 16:23:24.015924492  src/station.c:station_print_scan_bss()
> Processing BSS 'd8:ec:5e:99:0e:6c' with SSID: Revelotest4, freq: 2427,
> rank: 492, strength: -4500, data_rate: 72.2
> 2025-05-12 16:23:24.015937250  src/station.c:station_add_seen_bss()
> Added new Network "Revelotest4" security psk
>
>
> On another 2 device: (2025-05-08 date is incorrect it was before it
> got good time).  They in total had been up 30 minutes or so.
>
> device 2:
> 2025-05-08 17:00:09.699817830  src/station.c:station_add_seen_bss()
> Added new Network "Revelotest4" security wep
> 2025-05-12 16:33:47.901451708  src/station.c:station_add_seen_bss()
> Added new Network "Revelotest4" security psk
>
> device 3:
> 2025-05-08 17:00:06.777723005  src/station.c:station_add_seen_bss()
> Added new Network "Revelotest4" security wep
> 2025-05-12 16:33:49.145627332  src/station.c:station_add_seen_bss()
> Added new Network "Revelotest4" security psk
>
> That 2 devices do it at the same time - makes it seem like the router
> is doing some funky stuff.

Could you grab an iwmon pcap of this? Here you can see how the security 
level is determined, and its quite basic:

https://git.kernel.org/pub/scm/network/wireless/iwd.git/tree/src/common.c#n89

With an iwmon pcap we could see the exact bytes of the RSNE and see why 
IWD is categorizing it this way.

Thanks,
James

>
> Thank
> Bryce
>

Re: linksys router incorrectly showing as WEP?

[Bryce Johnson]

Hi James,

>
> Could you grab an iwmon pcap of this? Here you can see how the security
> level is determined, and its quite basic:
>

I'll give that a try, unfortunately I didn't have CONFIG_NLMON in the
kernel, I'll add that in now. They are also going to ship me the
problem router so I'll try and repo the issue in person, hopefully a
little more easily.

Thanks!
Bryce

Re: linksys router incorrectly showing as WEP?

[Denis Kenzior]

Hi Bryce,

On 5/12/25 1:24 PM, Bryce Johnson wrote:
> Hi James,
> 
>>
>> Could you grab an iwmon pcap of this? Here you can see how the security
>> level is determined, and its quite basic:
>>
> 
> I'll give that a try, unfortunately I didn't have CONFIG_NLMON in the
> kernel, I'll add that in now. They are also going to ship me the
> problem router so I'll try and repo the issue in person, hopefully a
> little more easily.
> 

This info would also show up in an air capture if iwmon is not available.

Regards,
-Denis