How to set a scan on a given frequency

How to set a scan on a given frequency

[Shengrong Yin]

Hello,

I was using iw to scan a given frequency.
For example,
iw wlan0 scan freq 2412 | grep freq:
However, the result was scanned ssids with different frequencies
across 2.4 GHz band, which is
freq: 2462
freq: 2462
freq: 2437
freq: 2412
...
Why this happened? Shouldn't it return only the ssid with 2412?
I tried to debug iw using ddd. But failed to trace from iw to netlink
library. I traced to
listen_events(state,ARRAY_SIZE(cmds), cmds)
and then I was expected to wait for the scanning result.
The iw tool did only send out the scan request. The netlink library
will handle the scan and call the API provided by mac80211.
Then mac80211 will then request scan from the driver.

Please correct me if I was wrong about the scanning steps.
Should I specify the given frequency for scanning directly in Mac80211?

My goal was to write my own user space process that can handle scan on
a given frequency within a shortest time. But only on one particular frequency.

Thanks,
-Shengrong

Re: How to set a scan on a given frequency

[James Cameron]

On Mon, Aug 31, 2015 at 03:53:18PM -0500, Shengrong Yin wrote:
> Hello,
> 
> I was using iw to scan a given frequency.
> For example,
> iw wlan0 scan freq 2412 | grep freq:
> However, the result was scanned ssids with different frequencies
> across 2.4 GHz band, which is
> freq: 2462
> freq: 2462
> freq: 2437
> freq: 2412
> ...
> Why this happened? Shouldn't it return only the ssid with 2412?

No.  A radio receiver in a wireless device can receive beacons on
adjacent frequencies to the frequency it is tuned for.  The signal
strength will be lower, but not low enough to prevent receive.

If you want to restrict results to the frequency you are interested
in, then filter the data after you have received it from the kernel.

But the data returned to you isn't the frequency of the received radio
burst, but is the frequency value in the beacon packet.  Usually this
is the same, but faulty devices, deceptive devices, or high speed
movement could make it different.

You should specify a frequency in your scan request if you can,
because it shortens the time taken by the scan.  If you do not specify
a frequency, then the scan must be repeated for every channel.  There
is a time cost for switching, and a time spent listening on each
channel.

-- 
James Cameron
http://quozl.linux.org.au/

Re: How to set a scan on a given frequency

[Luca Coelho]

On Tue, 2015-09-01 at 12:53 +1000, James Cameron wrote:
> On Mon, Aug 31, 2015 at 03:53:18PM -0500, Shengrong Yin wrote:
> > Hello,
> > 
> > I was using iw to scan a given frequency.
> > For example,
> > iw wlan0 scan freq 2412 | grep freq:
> > However, the result was scanned ssids with different frequencies
> > across 2.4 GHz band, which is
> > freq: 2462
> > freq: 2462
> > freq: 2437
> > freq: 2412
> > ...
> > Why this happened? Shouldn't it return only the ssid with 2412?
> 
> No.  A radio receiver in a wireless device can receive beacons on
> adjacent frequencies to the frequency it is tuned for.  The signal
> strength will be lower, but not low enough to prevent receive.
> 
> If you want to restrict results to the frequency you are interested
> in, then filter the data after you have received it from the kernel.
> 
> But the data returned to you isn't the frequency of the received 
> radio
> burst, but is the frequency value in the beacon packet.  Usually this
> is the same, but faulty devices, deceptive devices, or high speed
> movement could make it different.
> 
> You should specify a frequency in your scan request if you can,
> because it shortens the time taken by the scan.  If you do not 
> specify
> a frequency, then the scan must be repeated for every channel.  There
> is a time cost for switching, and a time spent listening on each
> channel.

Yes, the results found in a scan are not filtered.  It's the same thing
if you specify an SSID in the scan command.  That only causes a
probe_req with the SSID to be sent out (instead of the default
"wildcard" SSID).  If other APs happen to beacon on the channels you're
scanning, you'll receive those results too (even if they are from other
SSIDs).

Additionally, you will also get results that were in the cache (which
lasts ~15 seconds).  This means that if you issue a full scan followed
by a scan on a single scan within 15 seconds of each other, the latter
will also return all the results found in the first one.

--
Luca.