devicescape logoexactEnter SearchCompanyProducts/TechnologyServicesNews/EventsSupportSpacerContactPartnersCustomersEnglish    ???
Products Photo  Product Documentation for 
 Devicescape Universal Wireless Platform 
  Documentation Home for Devicescape Universal Wireless Platform  | Package Guide
Package GuidePreviousNextIndex 
   

 
 
 hostapd package 
 
 Information on this package is covered here.
 
 Package 
 
 Description 
 
 License 
 
hostapd 
   
Access Point daemon. 
   
BSD,
GPL2 (GNU General Public License, v.2) 
 
Summary
 
Usage
 
Building the Package
 
Licensing
 
Related Packages
 
 Summary 
  
 The Host Access Point daemon (hostapd) manages user-space 802.11 functions such as authentication, encryption, initializing network interface, beacon intervals, extended authorization protocol (EAP) keys, etc. These are mainly the non-time critical functions required of a wireless Access Point. It also provides an interface into the DataPath driver for the management, transmission, and reception of wireless data packets. 
 
 Usage 
 
 
Starting/Stopping the hostapd Service
 
Runtime Configuration (hostapd.conf)
 
Modifying a Running Configuration
 
Quick Reference to Configuration Options in hostapd.conf
 
Options that Must be Configured in the Broadcom Driver
 
Basic Settings
 
Country Code and Regulatory Domain
 
Event Logging
 
IEEE 802.11 Radio Settings
 
MAC Filtering
 
Security
 
Quality of Service Queues
 
Rogue Detection
 
Layer 2 Update of Station Association (IAPP)
 
Wireless Distribution System (WDS)
 
Load Balancing
 
Rate Limit
 
Multiple SSID and BSSID
 
Example hostapd.conf Configuration Files
 
External APIs
 
Debugging
 
 Starting/Stopping the hostapd Service 
  
 Keep in mind that hostapd will not start at all unless the ACCESS_POINT variable in /etc/default/wireless is set to "yes". The access point profile package (ds-wireless-ap) provides a version of this file with access point behavior enabled. (See the Developer Guide topic on Creating Root File System Images for Reference Designs for information on building a reference AP using this profile package.) 
 
 Use the following commmands to control the hostapd service on the target device.
 
 Action 
 
 Command 
 
Start 
   
/etc/init.d/hostapd start 
   
Stop 
   
/etc/init.d/hostapd stop 
   
 Restart 
   
/etc/init.d/hostapd restart 
   
Reload 
   
 Reload the configuration file(s). 
 
 Configuration parameters should be set in the /etc/default/hostapd file. Available parameters are:
 
 Parameter 
 
 Description 
 
CONFIG_FILES 
   
 Specify the configuration file(s) that should be passed to the hostapd daemon when it is started. Multiple files can be specified using a quoted, space separated list. 
   
DEBUG_LEVEL 
   
 Set level of debug output.(See Debugging for details.) 
 
 Runtime Configuration (hostapd.conf) 
  
 Configuration of the Access Point is handled by the APconfd daemon. hostapd maintains an internal configuration file based on these settings. It passes control information and management frames to the DataPath driver. 
 
 The Host Access Point Daemon (hostapd) uses configuration files to set up values for all 802.11 related options. These files configure both the hostapd process and the kernel drivers for the related wireless LAN (WLAN) devices.
 
 Notes 
   
The interfaces described in this section, including all API's, file structures, data structures and scripting techniques (the interfaces), are subject to change in future versions of the Devicescape? Universal Wireless Platform. Should Devicescape change any of these interfaces, Devicescape does not guarantee nor warranty forward and/or backward compatibility between the new interfaces and those described herein.
 
Some options may not be supported in all drivers. For example, Broadcom driver (broadcom-wl-drv package) requires that you configure some options with the broadcom-wl tools (broadcom-wl package). See Options that Must be Configured in the Broadcom Driverand the driver-specific packages for options that require configuration external to hostapd.
 
 Each WLAN interface/radio has its own configuration file. A single hostapd process can be used to control more than one radio. During start-up, all configuration files must be listed on the command line. For example, following command line could be used to start hostapd as a daemon that forks to background (-B) and controls two WLAN devices (wlan0 and wlan1): 
./hostapd -B /etc/hostapd.conf-wlan0 /etc/hostapd.conf-wlan1
   
 The default configuration file is hostapd.conf. It is a text file. Empty lines are ignored. All lines starting with "#" are also ignored-use them to comment the file. An example configuration file is provided which includes comments about the available configuration items. 
 
 Most items have a sensible default values, but the interface, SSID, hardware mode, and channel and channel policy items at least should be explicitly configured as "basic settings". The basic settings are described first, followed by sections on how to configure the rest of the available options. 
 
 Note that "hostapd.conf" file is meant to serve as an example configuration file for the hostapd package. In practice, you might rename this file. When you create the root file system for an access point per the AP reference design (see Devicescape Developer Guide), example files are generated for /etc/hostapd (with a symbolic link to /config/etc/hostapd) directory. You can use these as reference configuration files. In most cases, the <hostapd>.conf file must be edited before bringing up the access point and you must specify which .conf file should be loaded when hostapd starts. That is, hostapd looks at this particular configuration file so that it knows which "<hostapd>.conf" to use. 
# cat /etc/default/hostapd
  
# Settings for the hostapd init script
  
# Specify all the config files, one per radio that
  
# will be running in access point mode
  
CONFIG_FILES="/etc/hostapd/atheros_a.conf"
  
# Set the level of debug output desired
  
DEBUG_LEVEL=1
   
 For multi-radio support, you can have two or more .conf files, separated by a space: 
CONFIG_FILES="/etc/hostapd/atheros_a.conf /etc/hostapd/broadcom_g.conf"
   
 Modifying a Running Configuration 
  
 A running configuration can be changed by modifying the configuration files and signaling the hostapd process with a SIGHUP signal hangup. This will cause the daemon to reload the configuration files and enable the new settings-assuming there are no syntax errors in the configuration files.
 
 Note 
   
 A better option than using SIGHUP is to use the API call RELOAD because it provides feedback to the caller about the completion of the reconfiguration. SIGHUP does not provide this feedback, and can easily cause race conditions with the AP configuration system in some cases (for example, when a SIGHUP command is followed by an interface configuration for a new WDS link). 
 
 Quick Reference to Configuration Options in hostapd.conf  
  
 Following is a summary of all configuration options in the hostapd.conf file for quick reference. (Note that some options may not be supported in all drivers. See driver-specific packages for options that require configuration external to hostapd.)
 
 Option 
 
 Examples and Notes 
 
 Where to Get More Info 
 
accept_mac_file 
   
 For MAC Filtering, define path to MAC accept file:
accept_mac_file=/etc/hostapd.accept 
   
 See Accept/Deny Files. 
   
adm_status 
   
 Turns radio interface on and off.
adm_status=up 
   
 See Administration Status. 
   
acct_server_addr
acct_server_port
acct_server_shared_secret 
   
 Define the RADIUS accounting server address, port (normally 1813), and shared secret.
acct_server_addr=127.0.0.1
acct_server_port=1813
acct_server_shared_secret=secret 
   
 See Authentication/Accounting Configuration in RADIUS. 
   
aifs 
   
 This is a QoS parameter. 
   
 See Quality of Service Queues, especially Queues. 
   
allow_non_wpa 
   
 In WPA security mode, allow non-WPA stations:
allow_non_wpa=1 
 
 Setting allow_non_wpa=0 means do not allow non-WPA stations to use this Access Point. 
 
 (See also wpa.) 
   
 See Wi-Fi Protected Access 
   
antenna_mode
antenna_sel 
   
 Set antenna mode to static (and set requisite default antenna):
antenna_mode=static
antenna_sel=1 
 
 Automatically select the best antenna to receive/transmit and switch in case of transmit failure (this is the default):
antenna_mode=omni_ap 
   
 See Antenna Diversity Configuration. 
   
ap_max_inactivity 
   
 Set station inactivity limit:
ap_max_inactivity=300 
 
 The setting shown is the default: 300 seconds (which is 5 minutes) 
   
 See Station Inactivity Limit. 
   
ap_table_max_size
ap_table_expiration_time 
   
 These are options related to passive scanning. 
   
 See Rogue Detection. 
   
assoc_min_rate 
   
 Set a minimum rate (in 100 kbps) needed for association:
assoc_min_rate=120 
 
 (If the minimum rate is set to 12 Mbps for a 802.11g Access Point, all 802.11b stations will be rejected.) 
   
 See Minimum Association Rate. 
   
atheros_super_ag 
   
 Enable all Super AG features:
atheros_super_ag=7 
 
 (As a prerequisite, to using Atheros Super AG, hw_mode must be set to "g": hw_mode=g) 
   
 See Hardware Mode and IEEE 802.11 ATHEROS SUPER AG Low-Level Hardware Setting 
   
auth_algs 
   
 Sets the authenticaton algorithm for both Open and Shared Key authentication:
auth_algs=3 
 
 (This is a WEP security setting.) 
   
 See Authentication Algorithm. 
   
auth_server_addr
auth_server_port
auth_server_shared_secret 
   
 Configure information about the RADIUS server:
auth_server_addr=127.0.0.1
auth_server_port=1813
auth_server_shared_secret=secret 
   
 See Authentication/Accounting Configuration in RADIUS. 
   
basic_rates 
   
 Set basic and supported rates for a mix of 802.11g and 802.11b stations:
supported_rates=10 20 55 110 60 90 120 180 240 360 480 540
basic_rates=10 20 55 110 
   
 See Rate Configuration. 
   
beacon_int 
   
 Send a Beacon frame every 100 milliseconds (10 per second):
beacon_int=100 
   
 See Beacon Interval. 
   
bridge_packets 
   
 Disable the internal bridge thereby enabling "station isolation":
bridge_packets=0 
 
 Enable the internal bridge thereby disabling "station isolation" (this is the default):
bridge_packets=1 
   
 See Station Isolation. 
   
bss 
   
 hostapd enables multiple BSSIDs by the addition of a bss configuration item. The bss item requires a default interface name to be allocated for the data packets of the new BSS:
bss=wlan0_0 
   
 See Multiple BSSID. 
   
burst 
   
 This is a QoS parameter. 
   
 See Quality of Service Queues, especially Queues. 
   
channel policy
channel 
   
 Disable channel management (default) and set channel:
channel_policy=0
channel=60 
 
 Automatically select best channel and allow it to change:
channel_policy=3 
   
 See Channel and Channel Policy. 
   
country_code 
   
country_code=US 
   
 See Country Code 
   
cts_protection_type 
   
 Set CTS protection for a mix of 802.11g and 802.11b stations:
cts_protection_type=0 
 
 (This is the default.) 
   
 See Clear-to-Send Frames (cts_protection_type). 
   
cwmin 
   
 This is a QoS parameter. 
   
 See Quality of Service Queues, especially Queues. 
   
cwmax 
   
 This is a QoS parameter. 
   
 See Quality of Service Queues, especially Queues. 
   
deny_mac_file 
   
 For MAC Filtering, define path to MAC deny file:
deny_mac_file=/etc/hostapd.deny 
   
 See Accept/Deny Files. 
   
dtim_period 
   
 Include DTIM message in every other Beacon:
dtim_period=2 
   
 Seee Delivery Traffic Information Messages. 
   
eapol_key_index_workaround 
   
 Microsoft Windows XP supplicant workaround when broadcast keys only are used:
eapol_key_index_workaround=0 
 
 This is not needed if individual unicast keys are used (when wep_key_len_unicast is set to 5, 13, or 16): 
   
 See Microsoft Windows XP Supplicant Workaround for Broadcast Keys 
   
eapol_reauth_period 
   
 An example of the default setting for how often IEEE 802.1X reauthentication is required (once an hour):
eapol_reauth_period=3600 
 
 Setting eapol_reauth_period=0 disables reauthentication for IEEE 802.1X security. 
   
 See IEEE 802.1X EAPOL Reauthentication Period. 
   
force_unicast_rate 
   
 Set transmission rate (in 100 kbps) for all unicast frames:
force_unicast_rate=240 
 
 (Stations that do not support this rate cannot associate.) 
   
 See Forced Transmission Rate 
   
fragm_threshold 
   
 Disable fragmentation threshold:
fragm_threshold=2346 
 
 (The range is 0 to 2346 where 2346 is "disabled") 
   
 See Fragmentation Threshold. 
   
framed_mtu 
   
 Define value for Framed-MTU attribute in RADIUS messages:
framed_mtu=1400 
 
 Limits size EAP messages (by fragmenting them) to fit MTU of the wireless interface 
   
 See Framed MTU. 
   
hwmode 
   
hw_mode=g 
   
 See Hardware Mode. 
   
iapp_interface 
   
 Prerequisite setting for layer2_update. 
   
 See Layer 2 Update of Station Association (IAPP). 
   
ieee80211d 
   
 Enable sending country code in Beacons:
ieee80211d=1 
   
 See IEEE 80211d Setting for Sending Country Code and Accepted Frequencies in Beacon Frames 
   
ieee8021x 
   
 Enable IEEE 802.1x security:
ieee8021x=1 
   
 See 802.1x Authentication. 
   
ignore_broadcast_ssid 
   
 Set Access Point to not send SSID in its Beacons. (Require client stations to know the SSID):
ignore_broadcast_ssid=1 
   
 See Broadcast SSID Setting. 
   
inactivity_policy 
   
 Example of default station inactivity policy configuration:
inactivity_policy=0 
   
 See Station Inactivity Policy. 
   
interface 
   
interface=wlan0 
   
 See Interface. 
   
layer2_update 
   
hostapd provides support for Layer 2 Update frames to update bridge learn tables when a station associates. 
 
 See also iapp_interface which is prerequisite setting for layer2_update. 
   
 See Layer 2 Update of Station Association (IAPP). 
   
load_balance_threshold
load_balance_threshold_st
load_balance_assoc_limit 
   
 Load balancing is disabled by default (load_balance_threshold=0) 
   
 See Load Balancing for details on setting these options. 
   
logger_syslog
logger_syslog_level
logger_stdout
logger_stdout_level 
   
 Include all modules and set minimum priority level to "2"; only information messages, notifications and warnings get logged.
logger_syslog=-1
logger_syslog_level=2
logger_stdout=-1
logger_stdout_level=2 
   
 See Event Logging. 
   
key_tx_rx_threshold 
   
 For dynamically generated encryption keys (in IEEE 802.1X or WPA security), change a key after its been used a specified number of times:
key_tx_rx_threshold=1000000 
 
 To disable rekeying threshold:
key_tx_rx_threshold=0 
 
 (See also wep_rekey_period.) 
   
 See WEP Rekeying Threshold. 
   
macaddr_acl 
   
 For MAC Filtering, deny station unless it is listed in access control list (ACL):
macaddr_acl=1 
 
 (If set to "0" stations are accepted unless in ACL; if set to "2" RADIUS server is consulted after local ACL is searched.) 
   
 See Access Control List for Station MAC Addresses. 
   
max_num_sta 
   
 Restrict number of associations to this Access Point to 255:
max_num_sta=255 
   
 See Maximum Station Associations. 
   
max_ratectrl_rate 
   
 Set a maximum transmission rate:
max_ratectrl_rate=360 
   
 See Maximum Transmission Rate 
   
multi_ssid 
   
 Define multiple SSIDs:
multi_ssid=GuestAccess 
   
 See Multiple SSID and BSSID. 
   
minimal_eap 
   
 Example of default setting for internal EAP authentication server, "0" is disabled:
minimal_eap=0 
 
 To enable the internal authentication server:
minimal_eap=1. 
   
 See Embedded EAP Authentication Server for Testing Purposes. 
   
own_ip_addr 
   
RADIUS server setting to define IP Address of the access point running hostapd:
own_ip_addr=127.0.0.1 
   
 See Own IP Address in RADIUS. 
   
passive_scan_mode
passive_scan_interval
passive_scan_listen 
   
 hostapd uses passive scanning to locate other Access Points. This feature is provided as part of rogue detection, but can also be used for WDS and clustering. 
   
 See Rogue Detection for details on these options. 
   
preamble 
   
 Set short preamble (to improve efficiency of network throughput for 2, 5.5, 11 Mbps):
preamble=1 
   
 See IEEE 802.11b Preamble. 
   
radius_failover_limit 
   
 When multiple RADIUS servers are configured, set number of attempts to retry failed transmissions before fail-over to second RADIUS server:
radius_failover_limit=4 
   
 See Secondary RADIUS Servers and Fail-over and Server Retry. 
   
reg_domain_filename 
   
reg_domain_filename=/etc/reg_domains.conf 
   
 See File Name for Regulatory Domain Information. 
   
rsn_preauth
rsn_preauth_interfaces 
   
 Enable IEEE 802.11i/RSN/WPA2 pre-authentication to speed up roaming:
rsn_preauth=1 
 
 By default, this option is disabled (rsn_preauth=0). 
 
 Define space separated list of interfaces from which pre-authentication frames are (for example, 'eth0' or 'eth0 wlan0wds0':
rsn_preauth_interfaces=eth0 
   
 See IEEE 802.11i/RSN/WPA2 Preauthentication in Wi-Fi Protected Access 
   
rts_threshold 
   
 Disable RTS/CTS threshold:
rts_threshold=2347 
 
 (The range is 0 to 2347 where 2347 is "disabled".) 
   
 See RTS/CTS Threshold. 
   
security_policy 
   
 Set the security mode for the secondary SSID in a multi-SSID configuration. 
 
 This requires additional configuration depending on which security policy you set. 
   
 See Security Policy. 
   
ssid 
   
ssid=test 
   
 See SSID. 
   
supported_rates 
   
 Set basic and supported rates for a mix of 802.11g and 802.11b stations:
supported_rates=10 20 55 110 60 90 120 180 240 360 480 540
basic_rates=10 20 55 110 
   
 See Rate Configuration. 
   
tx_fail_percentage_limit
tx_fail_interval 
   
 Set maximum acceptable failure percentage of TX packets and deauthenticate stations that miss the cut-off:
tx_fail_percentage_limit=20
tx_fail_interval=10 
 
 (If either option is set to 0, this limitation on failure percentages is disabled; which is the default.) 
   
 See Maximum Failure Percentage for Transmissions. 
   
tx_power_adjustment 
   
 Depracated. Use tx_power_reduction. 
   
   
tx_power_reduction 
   
 Disable tx_power_reduction:
tx_power_reduction=0 
 
 (The default is disabled. When set to something other than 0, tx_power_reduction reduces the power output of a radio per the algorithm described in the Transmission Power.) 
   
 See Transmission Power. 
   
tx_queue_* 
   
tx_queue_* options are QoS parameters for AP-to-station traffic. 
   
 See Quality of Service Queues, especially Default QoS Parameters for Access Point (AP-to-STA Traffic). 
   
vlan 
   
 Set VLANs, which are bou:
vlan=wlan0_wep 
   
 See Multiple SSID and BSSID 
   
wds
wds_ap
wds_assoc
wds_remote_addr
wds_security_policy
wds_wep_key

 
   
 Configure WDS link between two APs:
wds=wlan0wds0
wds_remote_addr=00:11:11:11:11:11
wds_ssid=wds-ssid
wds_security_policy=3
wds_wpa_psk_ascii=12345678
wds_ap=1
wds_assoc=1 
 
wds=wlan0wds4
wds_remote_addr=00:44:44:44:44:44
wds_ssid=wds-ssid
wds_security_policy=1
wds_wep_key="abcde"
wds_ap=1
wds_assoc=1 
 
wds=wlan0wds1
wds_remote_addr=00:22:22:22:22:22
wds_wep_key="abcde" 
 
wds=wlan0wds2
wds_remote_addr=00:33:33:33:33:33 
   
 See Wireless Distribution System (WDS). 
   
wep_keyNumber
wep_default_key 
   
 Set WEP keys in hexadecimal or ASCII (double-quoted) strings. Examples and notation: 
 
wep_key0=1A2B3C4D5E (40-bit, hexadecimal)
wep_key1="vwxyz" (40-bit, ASCII)
wep_key2=0102030405060708090A0B0C0D (104-bit, hexadecimal)
wep_key3=".2.4.6.8.0.23" (104-bit, ASCII) 
 
 Set the active key:
wep_default_key=0 
   
 See Static WEP Security. 
   
wep_key_len_broadcast
wep_key_len_unicast 
   
 For dynamic WEP keys, define length of generated keys in bytes (5 for 40-bit, 13 for 104-bit, or 16 for 128-bit WEP secret key):
wep_key_len_broadcast=13
wep_key_len_unicast=13 
 
 (Above example sets dynamic WEP keys at 104-bit length.) 
   
 See Dynamic WEP Keying. 
   
wep_rekey_period 
   
 Define WEP rekeying interval (in seconds) and send to stations using EAPOL-Key frames:
wep_rekey_period=300 
 
 If this is set to 0, WEP keys are only generated once. 
 
 (See also key_tx_rx_threshold.) 
   
 See WEP Rekeying Interval. 
   
wme_ac_* 
   
 These are QoS parameters for clients. 
   
 See Quality of Service Queues, especially Default QoS Parameters for Clients (STA-to-AP Traffic). 
   
wpa 
   
 Enable WPA security mode:
wpa=1 
   
 See Wi-Fi Protected Access. 
   
wpa* 
   
 For details on wpa_use_psk, wpa_psk_hex, wpa_poll_interval, and other wpa* options, see Wi-Fi Protected Access. 
   
 See Wi-Fi Protected Access. 
 
 Options that Must be Configured in the Broadcom Driver 
  
 For the Broadcom driver, the following options currently must be configured in that driver using the Broadcom wl tools: 
 
Wireless Distribution Subsystem (WDS)
 
MAC Filtering
 
The following IEEE 80211 Radio Settings:
 
IEEE 802.11b Preamble
 
Clear-to-Send Frames
 
Rate Configuration
 
Forced Transmission Rate
 
Transmission Power
 
 For information on how to configure these features in the Broadcom driver, see hostapd.conf Options Requiring External Configuration with Broadcom wl in broadcom-wl-drv package and broadcom-wl package.
 
 Notes 
   
 Also, please note: 
 
For a Broadcom bridge interface you must add the following line in the hostapd.conf file:
bridge=<BridgeName> (for example, bridge=br0). Whereas in the Atheros driver, creating the bridge (in an interfaces file or via command ine) is enough.
 
When using the Broadcom driver, you must add a the following line in the hostapd.conf file:
driver=broadcom.
 
Before starting hostapd, the Broadcom driver must be configured to access point mode with:
wl -i eth1 ap 1
 
 Basic Settings 
  
 At a minimum, configure these optons explicitly: 
 
Interface
 
SSID
 
Hardware Mode
 
Channel and Channel Policy
 
Check Country Code and Regulatory Domain
 
 Interface 
 
 Define the Linux network interface assigned for the WLAN device.
 
 Note 
   
 When the access point is transmitting or receiving management frames, it uses the defined interface with an "ap" postfix, for example, wlan0ap. 
interface=wlan0
   
 (See also Options that Must be Configured in the Broadcom Driver for information about setting up a bridge interface when using the Brodcom driver.) 
 
 SSID 
 
 The SSID to be used in 802.11 management frames: 
ssid=test
   
 This is the default SSID for the Access Point. 
 
 Hardware Mode 
 
 Select an operation mode. The configuration items are:
 
a 
   
 Sets the hardware mode to IEEE 802.11a 
   
b 
   
 Sets the hardware mode to IEEE 802.11b 
   
g 
   
 Sets the hardware mode to IEEE 802.11g or IEEE 802.11 Atheros Super AG. (For Atheros Super AG, see also IEEE 802.11 ATHEROS SUPER AG Low-Level Hardware Setting.) 
   
turbog 
   
 Sets the hardware mode to Atheros 2.4 GHz Turbo 
   
turbo 
   
 Sets the hardware mode to Atheros 5 GHz Turbo 
 
 An example of the hardware mode setting: 
hw_mode=g
   
 IEEE 802.11 ATHEROS SUPER AG Low-Level Hardware Setting 
 
 In order for the hardware mode "g" to leverage the full capacity of IEEE 802.11 Atheros Super AG, an additional setting must be specified on the driver. 
 
 The atheros_super_ag configuration item uses these bit fields:
 
 Flag Bit 
 
 Decimal
Value 
 
 Description 
 
 Bit 0 
   
 1 
   
 Enable fast frame support 
   
 Bit 1 
   
 2 
   
 Enable compression 
   
 Bit 2 
   
 4 
   
 Enable TurboPrime 
 
 Atheros SuperA/G is disabled by default: atheros_super_ag=0) 
 
 As an example, to enable all Super AG features: 
atheros_super_ag=7
   
 Channel and Channel Policy 
 
 Either the channel is set explicitly (channel_policy=0) and channel is set to the specified channel number or automatic channel selection is configured. There are three options for automatic channel selection:: 
 
Select the first available channel of the first available mode (channel_policy=1). In this case, the channel item is ignored.
 
Automatically select the best channel (channel_policy=2). In this case, the channel item is ignored.
 
Automatically select the best channel and allow channel to be changed (channel_policy=3).
 
 An example of the channel policy setting: 
channel_policy=0
  
channel=60
   
 Check Country Code and Regulatory Domain 
 
 By default, the country code and regulatory domain is set to operate on frequencies permitted in the United States. These settings should be modified as appropriate to operate on the frequency bands permitted in your country. See Country Code and Regulatory Domain. 
 
 Country Code and Regulatory Domain 
 
File Name for Regulatory Domain Information
 
Country Code
 
IEEE 80211d Setting for Sending Country Code and Accepted Frequencies in Beacon Frames
 
 File Name for Regulatory Domain Information 
 
 Different national and transnational authorities regulate different portions of the electromagnetic spectrum available for transmission. The 802.11 family of standards transmit and receive in unlicensed frequencies, using the 2.4 GHz band for 802.11b and 802.11g, and the 5 GHz band for 802.11a. There are differences in Channel range and Transmission Power levels for the different regulators. Regulators include the Federal Communications Commission (FCC), the European Telecommunications Standards Institute (ETSI), and the Telecom Engineering Center (MKK or TELEC). 
 
 An information file is provided that shows regulatory domain data; that is, the accepted frequencies associated with each country code. The reg_domain_filename configuration item is set to the default file name for regulatory domain data: 
reg_domain_filename=/etc/reg_domains.conf
   
 Country Code 
 
 The Country code (ISO/IEC 3166-1) is used to set the regulatory domain, which limits the available channels and transmit power to the values allowed by the specified regulator. 
 
 By default, the country code is set to "US", which sets it to transmit at radio frequencies permitted in the United States: 
country_code=US
   
 IEEE 80211d Setting for Sending Country Code and Accepted Frequencies in Beacon Frames 
 
 Enable IEEE 802.11d setting to transmit country code and accepted frequencies in beacon frames. (By default, this setting is disabled (ieee80211d=0). 
ieee80211d=1
   
 Event Logging 
 
 
System Logs and Standard Output
 
Bit Fields and Selected Modules
 
Setting Severity Level
 
Example Log Settings
 
 System Logs and Standard Output 
 
hostapd supports event logging both to syslog and stdout, the latter usually used for debugging only. Events like IEEE 802.11 authentication, associations, and IEEE 802.1x authorization are sent to the event log. 
 
 Bit Fields and Selected Modules 
 
 The logger_syslog and logger_stdout items are bit fields used to select which modules are included in the event logging. -1 selects all modules. Currently used module bits:
 
 Flag Bit 
 
 Decimal
Value 
 
 Description 
 
 Bit 0 
   
1 
   
 IEEE 802.11 module 
   
 Bit 1 
   
2 
   
 IEEE 802.1X module 
   
 Bit 2 
   
4 
   
 WPA module 
   
 Bit 3 
   
8 
   
 RADIUS module 
   
 Bit 4 
   
16 
   
 MLME module 
   
 Bit 5 
   
32 
   
 Driver Interface module 
 
 Setting Severity Level 
 
 The logger_syslog_level and logger_stdout_level set the minimum priority level to be logged. Specifying a level indicates to log events at the specified level or higher. The options are:
 
0 
   
 Verbose debugging 
   
1 
   
 Debugging 
   
2 
   
 Informational messages 
   
3 
   
 Notification 
   
4 
   
 Warning 
 
 Example Log Settings 
 
 This example configuration includes all modules and sets the minimum priority level to "2", which means only informational messages, notifications and warnings will be logged: 
logger_syslog=-1
  
logger_syslog_level=2
  
logger_stdout=-1
  
logger_stdout_level=2
   
 IEEE 802.11 Radio Settings 
 
 
Administration Status
 
Beacon Interval
 
Delivery Traffic Information Messages
 
Maximum Station Associations
 
RTS/CTS Threshold
 
Fragmentation Threshold
 
IEEE 802.11b Preamble
 
Clear-to-Send Frames (cts_protection_type)
 
Rate Configuration
 
Forced Transmission Rate
 
Maximum Transmission Rate
 
Minimum Association Rate
 
Maximum Failure Percentage for Transmissions
 
Transmission Power
 
Antenna Diversity Configuration
 
Station Inactivity Limit
 
Station Inactivity Policy
 
 Administration Status 
 
 Turns radio interface on and off. Valid values are "up" and "down". If interface is down (off), no frames are transmitted or received. The default is "up". 
adm_status=up
   
 Beacon Interval 
 
 Beacon frames are transmitted by an access point at regular intervals to announce the existence of the wireless network. 
 
 Define the beacon interval in k?sec (1.024 ms). The default behavior is to send a beacon frame once every 100 milliseconds (or 10 per second): 
beacon_int=100
   
 Delivery Traffic Information Messages 
 
 The Delivery Traffic Information Map (DTIM ) message is an element included in some Beacon frames. It indicates which client stations, currently sleeping in low-power mode, have data buffered on the access point awaiting pick-up. 
 
hostapd can vary the frequency of DTIM messages being inserted in its Beacon frames. The range is 1 to 255 where 1 indicates every Beacon includes a DTIM message: 
dtim_period=2
   
 Maximum Station Associations 
 
 The 802.11 standard specifies a limit of 2007 different association IDs. You can restrict the stations in your station table to fewer with this configuration item. Once max_num_sta have been added to the station table, new stations will be rejected. 
max_num_sta=255
   
 RTS/CTS Threshold 
 
 Set the Request-to-Send (RTS) / Clear-to-Send (CTS) threshold with the rts_threshold configuration item. The range is 0 to 2347 (disabled): 
rts_threshold=2347
   
 If the rts_threshold configuration item is not included in hostapd.conf, hostapd will not control the RTS threshold. You can use the command iwconfig wlan# rts val to set it. 
 
 Fragmentation Threshold 
 
 Set the Fragmentation threshold with the fragm_threshold configuration item. The range is 0 to 2346 (disabled): 
fragm_threshold=2346
   
 If the fragm_threshold configuration item is not included in hostapd.conf, hostapd will not control the fragmentation threshold. You can use the command iwconfig wlan# frag val to set it. 
 
 IEEE 802.11b Preamble 
 
 IEEE 802.11b supports a short or long preamble. The long preamble uses the legacy 802.11 1 and 2 Mbps DSSS header. The short preamble option was provided to improve the efficiency of a network's throughput. The preamble is used to allow stations to synchronize with the access point signal. The options are:
 
0 
   
 Use long preamble 
   
1 
   
 Use short preamble for 2, 5.5, 11 Mbps 
 
 
 Note 
   
 This affects only 802.11b and 802.11g modes. If one or more associated stations do not support the short preamble, the access point will automatically use the long preamble regardless of this setting. 
 
 Example preamble setting: 
preamble=1
   
 
 Note 
   
 For the Broadcom driver, the preamble must be configured in that driver using the Broadcom wl tools. For information on how to configure these features in the Broadcom driver see hostapd.conf Options Requiring External Configuration with Broadcom wl and broadcom-wl package. 
 
 Clear-to-Send Frames (cts_protection_type) 
 
802.11g uses Clear-to-Send (CTS) frames to stop 802.11b stations from interfering with frames sent at higher rates. This is useful in mixed mode networks consisting of both 802.11b and 802.11g stations. This behavior is automatically disabled if there are no 802.11b stations associated with the access point. 
 
 Override this behavior with the cts_protection_type configuration item. Its options are:
 
0 
   
 Use CTS protection when there are both 802.11g and 802.11b stations associated with this access point or when or when Overlapping Legacy BSS Condition (OLBC) is detected. 
 
 This is the default. 
   
1 
   
 Force CTS protection even if there are no 802.11b stations associated with this access point 
   
2 
   
 Disable CTS protection even when there are 802.11b stations associated with this access point 
   
3 
   
 Like 0 (auto detection), but do not use OLBC detection 
 
 .
 
 Note 
   
 OLBC is required for Wi-Fi certification of IEEE 802.11g AP and thus, only the default setting (0) can pass the certification test. 
 
 OLBC refers to the case where one of the overlapping BSSes (that is, another AP on the same channel) is either itself IEEE 802.11b-only or has IEEE 802.11b-only stations. IEEE 802.11b stations that do not support the new IEEE 802.11g rates are considered "legacy". 
 
 Example of setting CTS protection for both 802.11g and 802.11b stations: 
cts_protection_type=0
   
 It can be useful to enable CTS protection for an 802.11g-only access point where there are 802.11b stations on the same channel using another access point. Alternatively, disabling this even when 802.11b stations are present can improve performance, if most of the traffic is between 802.11g devices.
 
 Note 
   
 For the Broadcom driver, the "clear-to-send (CTS)" setting must be configured in that driver using the Broadcom wl tools. For information on how to configure these features in the Broadcom driver see hostapd.conf Options Requiring External Configuration with Broadcom wl and broadcom-wl package. 
 
 Rate Configuration 
 
 The default is to enable all rates supported by the hardware. This configuration item allows the list to be filtered so that only the defined rates are left in the list. If the list is empty, all rates are used. The list can have entries that are not in the range of rates the hardware supports-such entries are ignored. The entries in this list are in 100 kbps, where 11 Mbps = 110. 
 
 If this item is present, at least one rate has to match the rates the hardware supports. 
 
 The basic rate set configuration is a list of rates (in 100 kbps) that are included in the basic rate set. If this item is not defined, a reasonable default set is used. 
 
 Example values: 
supported_rates=60 90 120 180 240 360 480 540
  
basic_rates=60 120 240
   
802.11b: 
supported_rates=10 20 55 110
  
basic_rates=10 20
   
802.11g only: 
supported_rates=60 90 120 180 240 360 480 540
  
basic_rates=60 120 240
   
802.11g in mixed mode with 802.11b stations: 
supported_rates=10 20 55 110 60 90 120 180 240 360 480 540
  
basic_rates=10 20 55 110
   
 
 Note 
   
 For the Broadcom driver, the "rate configuration" setting must be configured in that driver using the Broadcom wl tools. For information on how to configure these features in the Broadcom driver see hostapd.conf Options Requiring External Configuration with Broadcom wl and broadcom-wl package. 
 
 Forced Transmission Rate 
 
 This configuration item allows you to configure a transmission rate (in 100 kbps) that will be used for all unicast frames. Configuring this item will also prevent stations that do not support the forced rate from associating with the Access Point: 
force_unicast_rate=240
   
 The rate must be one of the supported rates (supported_rates) defined in Rate Configuration above. 
 
 Note that the force_unicast_rate is only used for rate selection of TX frames; that is, STAs (stations) can still send frames at other supported rates and the AP will accept them.
 
 Note 
   
 For the Broadcom driver, the "forced transmission rate" setting must be configured in that driver using the Broadcom wl tools. For information on how to configure these features in the Broadcom driver see hostapd.conf Options Requiring External Configuration with Broadcom wl and broadcom-wl package. 
 
 Maximum Transmission Rate 
 
 This configuration item allows you to set a maximum limit on the transmission rate for the rate control algorithm in use. By default, this option is disabled (0) which allows any supported rate to be used. 
 
 If set, this option overrides rates in the supported rate set that are above the specified maximum transmission rate. 
 
 Example of setting a maximum transmission rate: 
max_ratectrl_rate=360
   
 Minimum Association Rate 
 
 This configuration item allows you to set a minimum rate (in 100 kbps) required for association. If a client station does not support any rates equal to or greater than this rate, association will be rejected. If the minimum rate is set to 12 Mbps for a 802.11g Access Point, all 802.11b stations will be rejected. 
assoc_min_rate=120
   
 Maximum Failure Percentage for Transmissions 
 
 This configuration item allows you to set the maximum acceptable failure percentage for transmitted packets (percentage of packets that failed even after all retry attempts). This can be used, for example, with Forced Transmission Rate to remove STAs that are not close enough to use the configured rate. 
 
 If the failure percentage is larger than tx_fail_percentage_limit, STA will be deauthenticated. This verification is done every tx_fail_interval seconds. 
 
 If either of these options is set to 0 (or not set in hostapd.conf), transmission failure limitation is disabled (this is the default). 
 
 Example of setting a maximum failure percentage of TX packets: 
tx_fail_percentage_limit=20
  
tx_fail_interval=10
   
 Transmission Power 
 
 Under certain circumstances, you may require reduced transmit power. For example, you may have a situation where two radios are transmitting and receiving on nearby channels. To prevent one radio from interfering with the other, you may want to reduce its power. 
 
 The tx_power_reduction configuration item reduces the power output of a radio by the value of tx_power_reduction in dBm as follows: 
tx_power = MIN(MaxPowerRegulatoryDomain, MaxPowerHardware)- tx_power_reduction
   
 Where "MaxPowerRegulatoryDomain" is the maximum power level allowed in the current regulatory domain to which the Access Point is set and "MaxPowerHardware" is the maximum power level supported by the hardware. 
 
 This field can be entered in 0.1 dBm precision, but the hardware driver may round it when needed. For example, Atheros ar5212 driver uses 0.5 dBm precision. 
 
 The default for tx_power_reduction is 0: 
tx_power_reduction=0
   
 (The tx_power_adjustment configuration item has been deprecated. Use tx_power_reduction instead.)
 
 Note 
   
 For the Broadcom driver, the "transmission power" setting must be configured in that driver using the Broadcom wl tools. For information on how to configure these features in the Broadcom driver see hostapd.conf Options Requiring External Configuration with Broadcom wl and broadcom-wl package. 
 
 Antenna Diversity Configuration 
 
 If the wlan card is known to have two antenna connectors, antenna diversity (the default) may be used. This can improve performance of the AP by automatically selecting the best antenna for receive and transmit. However, if only one antenna is connected but there are two connectors (one is empty), it is recommended that antenna diversity be disabled. 
 
 Select Defalut Antenna 
 
 Select the default antenna number (1 or 2). 
 
 For example: 
antenna_sel=1
   
 
 Note 
   
 Note that a default antenna must be set if antenna_mode is set to static. 
 
 Select Antenna Mode 
 
 Specify an antenna mode. The options are:
 
static 
   
 Always use default antenna. 
   
omni_ap 
   
 Switch to another antenna in case of transmission failure, (This is the default setting.) 
 
 An example of setting antenna mode to static (and requisite default antenna): 
antenna_mode=static
  
antenna_sel=1
   
 Station Inactivity Limit 
 
 If a station does not transmit at all in ap_max_inactivity seconds, the AP sends an empty data frame to that station in order to verify whether it is still in range. If this frame is not acknowledged (ACKed), the station will be disassociated and then deauthenticated. This feature is used to clear station table of old entries when the STAs move out of the range. 
 
 The station can associate again with the AP if it is still in range; this inactivity poll is just used as a nicer way of verifying inactivity. That is, a client will not report a broken connection because disassociation frame is not sent immediately without first polling the STA with a data frame. 
 
 The default station inactivity limit is 300 seconds (that is, 5 minutes): 
ap_max_inactivity=300
   
 Station Inactivity Policy 
 
 By default, the policy is to assume a station is active if it acknowledges the poll frame, and to dissassociate/deauthenticate stations that do not acknowledge. 
 
 You can also set the station inactivity policy to use ap_max_inactivity value as a direct time window after which non-ACK stations will be dissassociated and deauthenticated.
 
0 
   
 Poll STA with data frame and assume it is still active if the poll frame is acknowledged (ACKed). 
 
 This is the default. 
   
1 
   
 Deauthenticate the STA after it has been inactive more than ap_max_inactivity seconds 
 
 Example of the default station inactivity policy configuration: 
inactivity_policy=0
   
 MAC Filtering
 
 
 Note 
   
 For the Broadcom driver, MAC Filtering must be configured in that driver using the Broadcom wl tools. For information on how to configure these features in the Broadcom driver see hostapd.conf Options Requiring External Configuration with Broadcom wl and broadcom-wl package. 
 
 
 Access Control List for Station MAC Addresses 
 
hostapd supports an access control list (ACL) for 802.11 authentication. This is based on station MAC addresses. It can be configured as a local list in the hostapd configuration and/or as an external list using a RADIUS server. Its options are 0 = accept station unless it is listed in deny list (use only deny list and default to accept), 1 = deny station unless it is listed in accept list (use only allow list and default to deny), or 2 = use an external RADIUS server (local accept/deny lists are searched first): 
macaddr_acl=1
   
 When using an external RADIUS server, the local accept/deny lists are first searched for a match. If neither list contains the MAC address in question, the RADIUS server is queried (see RADIUS below). 
 
 Accept/Deny Files 
 
 The accept and deny lists are stored in files identified by the accept_mac_file and deny_mac_file configuration items. Each defines an absolute path name to a file: 
accept_mac_file=/etc/hostapd.accept
  
deny_mac_file=/etc/hostapd.deny
   
 Each file contains lists of MAC addresses, one per line in "00:12:34:56:78:9a" format. These accept/deny lists can be shared by multiple hostapd.conf files, where each configuration file has these configuration items pointing to the same files. 
 
 Security
 
 
 Note 
   
 For information about security on WDS links, see Wireless Distribution System (WDS). 
 
 
 The following settings configure security on the wireless network established by an Access Point (AP): 
 
Authentication Algorithm
 
Static WEP Security
 
802.1X Security
 
RADIUS
 
Wi-Fi Protected Access
 
Broadcast SSID Setting
 
Station Isolation
 
Security Policy
 
 Authentication Algorithm 
 
 The 802.11 standard specifies two authentication algorithms. Open system authentication should be used with 802.1x. Shared Key authentication requires WEP. hostapd can be configured to allow one or both of these authentication methods. It uses a bit map to determine the selected method(s). 
 
 Bit fields of allowed authentication algorithms.
 
 Flag Bit 
 
 Decimal
Value 
 
 Description 
 
 0 
   
1 
   
 Open System Authentication 
   
 1 
   
2 
   
 Shared Key Authentication 
 
 Valid combinations are:
 
1 
   
 Only Open System Authentication 
   
2 
   
 Only Shared Key Authentication 
   
 3 
   
 Both Open System and Shared Key Authentication (default) 
 
 
 Note 
   
 Shared Key is only used if static WEP key is also configured 
 
 For example, setting auth_algs to "3" sets the authenticaton algorithm to : 
auth_algs=3
   
 Static WEP Security 
 
hostapd supports the use of static WEP keys for encrypting data frames. When static keys are configured, dynamic 802.1x keying cannot be used at the same time-it would override these keys. 
 
 Defined Keys 
 
 There are four WEP keys defined. The keys can be 40-bit (64-bit with the 24-bit initialization vector (IV)), 104-bit (128-bit with the 24-bit IV), or 128-bit (152-bit with the 24-bit IV). 
 
 Note 
   
WPA does not include a 128-bit cipher type. This means that 128-bit WEP cannot be used as the Group cipher when using WPA with allow_non_wpa (see Wi-Fi Protected Access below) 
 
 The keys can be either hexadecimal or ASCII strings. If the key is an ASCII string, it must be double-quoted. For example: 
 
wep_key0=1A2B3C4D5E (40-bit, hexadecimal)
wep_key1="vwxyz" (40-bit, ASCII)
wep_key2=0102030405060708090A0B0C0D (104-bit, hexadecimal)
wep_key3=".2.4.6.8.0.23" (104-bit, ASCII) 
 
 Default Transmit Key 
 
 This configuration item selects the active key: 
wep_default_key=0
   
 802.1X Security 
 
hostapd can be configured to require successful 802.1x authorization before stations are allowed to send or receive data frames. In addition, 802.1x can be used to generate and send dynamic WEP keys for stations, to change these keys periodically (re-key), and to use individual (per station) keys for improved security. 
 
hostapd acts as the 802.1x Authenticator. It passes EAP authentication between the Supplicant (in the station) and the Authentication Server (RADIUS server). Any EAP type can be used in this authentication. However, to provide suitable keying material for dynamic WEP keying, the EAP type used must generate a secret session key. Examples of such EAP types are EAP-TLS, EAP-TTLS, and PEAP. An example of EAP that does not provide keying material is EAP-MD5. 
 
 802.1x Authentication 
 
 
 Note 
   
 This option must be enabled (ieee8021x=1) for both IEEE 802.1X and for WPA-RADIUS 
 
 The ieee8021x configuration item has these options:
 
0 
   
 IEEE 802.1x security is disabled. This is the default. 
   
1 
   
 IEEE 802.1x security is enabled. 
 
 For example, to enable IEEE 802.1x security: 
ieee8021x=1
   
 Embedded EAP Authentication Server for Testing Purposes 
 
 Use the internal minimal EAP Authentication Server for testing IEEE 802.1X. This should only be used for testing since it authorizes all users that support IEEE 802.1X without any keys or certificates. 
 
 By default, the internal minimal EAP authentication server is disabled (0): 
minimal_eap=0
   
 To enable it, set it to minimal_eap=1. 
 
 Dynamic WEP Keying 
 
 When dynamic WEP keys are to be used, these configuration items define the length of the generated keys in bytes, 5 for 40-bit, 13 for 104-bit, or 16 for 128-bit WEP secret key.
 
 Note 
   
WPA does not include a 128-bit cipher type. This means that 128-bit WEP cannot be used as the Group cipher when using WPA with allow_non_wpa (see Wi-Fi Protected Access below) 
 
 Both broadcast and unicast (individual, per station) keys can be used. In most cases, both should be enabled for added security. If these configuration items are set to zero, pseudo-random WEP keys are not generated for stations: 
wep_key_len_broadcast=13
  
wep_key_len_unicast=13
   
 WEP Rekeying Interval 
 
 This configuration item defines the WEP rekeying interval (in seconds). If this is set to 0, WEP keys are only generated once. Otherwise, the WEP keys will be regenerated every n seconds and sent to the stations using EAPOL-Key frames: 
wep_rekey_period=300
   
 WEP Rekeying Threshold 
 
 When using dynamically generated encryption keys (IEEE 802.1X or WPA), hostapd can be configured to change a key after it has been used certain number of times either to encrypt or decrypt frames. Similarly, rekeying can be configured based on a timeout. If both of the limits are set, rekeying will be performed whenever the first limit triggers. 
 
 If key_tx_rx_threshold is not included in the configuration file, hostapd will not control this parameter. The "iwpriv wlan# param 1024 <threshold>" can be used instead. 
 
 Setting key_tx_rx_threshold to 0 disables usage based rekeying threshold. This configuration item is shared by all virtual interfaces of a single radio. 
key_tx_rx_threshold=1000000
   
 Microsoft Windows XP Supplicant Workaround for Broadcast Keys 
 
 If only broadcast keys are used (wep_key_len_unicast=0), the Microsoft Windows XP Supplicant does not take keys into use. A workaround for this is to set bit 7 (unicast) in the EAPOL-Key frames even for broadcast keys. 
 
 This is not needed if individual unicast keys are used (wep_key_len_unicast is set to 5, 13, or 16): 
eapol_key_index_workaround=0
   
 Framed MTU 
 
 This defines the value to be used as Framed-MTU attribute in RADIUS messages. It is used to limit the size of the EAP messages (by fragmenting them) to fit MTU of the wireless interface. With 802.11, this could be as large as 2304 bytes. Ethernet has an MTU of 1500 bytes. For best performance, you should set this to be equal to or less than the MTU of the network media. 
framed_mtu=1400
   
 IEEE 802.1X EAPOL Reauthentication Period 
 
 The IEEE 802.1X EAPOL reauthentication option can be used to configure how often IEEE 802.1X reauthentication is required. The default is to require reauthentication once an hour (every 3600 seconds). 
 
 If this option is set to 0 (eapol_reauth_period=0), reauthentication will be disabled. 
 
 An example of the default setting for IEEE 802.1X reauthentication: 
eapol_reauth_period=3600
   
 RADIUS 
 
 When an external RADIUS server is used for an ACL query, an Access-Request packet is sent with the station's MAC address contained in both the User-Name and User-Password attributes. This address is encoded as a hex string without any delimiters between octets (for example, 0A:1B:2C:3D:4E:5F is encoded as 0A1B2C3D4E5F). If needed, this format can be changed by modifying RADIUS_ADDR_FORMAT in hostapd/radius.h. The access control list on the RADIUS server should be configured with User-Name/User-Password pairs. 
 
 Information about the RADIUS server must be configured when hostapd is used with RADIUS-based access control list for 802.11, 802.1x authentication using an external Authentication server, WPA with RADIUS authentication, or RADIUS accounting. 
 
 Own IP Address 
 
 The IP Address of the access point running hostapd. This is used in NAS-IP-Address attribute in RADIUS packets. It should be the same the IP Address the access point uses when sending UDP packets to the RADIUS server. (By default, this option is not set.) 
own_ip_addr=127.0.0.1
   
 Authentication/Accounting Configuration 
 
 Information about the RADIUS server must be configured in the following auth_server_* items, defining the authentication server address, port (normally 1812), and shared secret. 
auth_server_addr=127.0.0.1
  
auth_server_port=1813
  
auth_server_shared_secret=secret
   
 The following items define the RADIUS accounting server address, port (normally 1813), and shared secret. 
acct_server_addr=127.0.0.1
  
acct_server_port=1813
  
acct_server_shared_secret=secret
   
 The RADIUS server must also be configured to allow this access point as a client. The client list on RADIUS servers is usually a list of pairs: Access Point IP Address and shared secret.
 
 Note 
   
 Configuring RADIUS Accounting server will automatically enable station accounting. 
 
 The same configuration is shared with 802.1x authentication. 
 
 Secondary RADIUS Servers 
 
 Secondary RADIUS servers can be specified to use if primary one does not reply to RADIUS packets. These are optional and there can be more than one secondary server listed. 
auth_server_addr=127.0.0.2
  
auth_server_port=1812
  
auth_server_shared_secret=secret2
  
acct_server_addr=127.0.0.2
  
acct_server_port=1813
  
acct_server_shared_secret=secret2
   
 Fail-over and Server Retry 
 
 If more than one RADIUS server is configured, fail-over to another server will be tried after more than radius_failover_limit attempts for any RADIUS packet fails. 
radius_failover_limit=4
   
 This configuration item specifies the retry interval for trying to return to the primary RADIUS server (in seconds). RADIUS client code will automatically try to use the next server when the current server does not reply to requests. If this interval is set, primary server will be retried after configured amount of time even if the currently used secondary server is still responding. 
radius_retry_primary_interval=600
   
 Wi-Fi Protected Access 
 
 Support for WPA in hostapd is enabled with the wpa configuration item (0 = do not use WPA or 1 = use WPA): 
wpa=1
   
 Enforcing WPA access is done with the allow_non_wpa configuration item. For example: 
allow_non_wpa=1
   
 Setting allow_non_wpa=0 means do not allow non-WPA stations to use this Access Point. 
 
 Setting allow_non_wpa=1 means allow non-WPA IEEE 802.1X stations. (This setting does not allow "un-authenticated" stations; IEEE 802.1X authentication is required for the non-WPA stations.)
 
 Note 
   
 Setting allow_non_wpa will decrease the security of the network since it requires use of insecure encryption algorithm (WEP) for the broadcast and multicast frame. This mode should only be used as a temporary solution when upgrading an existing IEEE 802.1X network to use WPA. 
 
 WPA-PSK 
 
 Instead of using a RADIUS server, hostapd can use a pre-shared key (PSK). If wpa_use_psk is set (0 = use a RADIUS server, 1 = use a pre-shared key), the Access Point needs a 256-bit pre-shared key. This can be entered as 64 hex characters (wpa_psk_hex) or using ASCII password (wpa_psk_ascii) that will be converted to 256-bit key. Only one of these fields can be included in the configuration file. The minimum length of the ASCII password is 8 characters and its maximum length is 63 characters. However, it should be longer than 20 characters and contain letters, numbers, and other symbols. 
wpa_use_psk=1
  
wpa_psk_hex=0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDE
F
  
#only use one psk - hex or ascii
  
#wpa_psk_ascii=very secret password A0! with non-letters on it
   
 Set the WPA rekeying interval for Group Keys (in seconds; 0 = rekeying disabled): 
wpa_group_rekey=60
   
 Set the WPA rekeying interval for the Group Master Key (in seconds; 0 = rekeying disabled): 
wpa_gmk_rekey=86400
   
 Select the Pairwise Cipher Suites (1 = TKIP, 2 = CCMP (AES), and 3 = both TKIP and CCMP are allowed): 
wpa_pairwise_cipher=1
   
 
 Notes 
   
Notice that in the hostapd.conf file, the wpa_psk_ascii value does not take double quotes around the value. The configuration example shown above will work properly (no double quotes around the password value). Whereas, something like wpa_psk_ascii="my secret password" will fail. This is in contrast to setting the psk value in wpa_supplicant (wpa_supplicant.conf) which in fact requires double quotes for such a value.
 
Current Wi-Fi Alliance certification process only tests TKIP CCMP and TKIP and CCMP modes may have interoperability issues with some client implementations.
 
 Microsoft Windows XP WPA Supplicant Workaround for TKIP and CCMP 
 
 Microsoft XP WPA Supplicant seems to have a bug that prevents it from working with TKIP when the AP supports both TKIP and CCMP. This workaround can be used to instruct hostapd to try changing message 3/4 of four-way handshake to a format that Microsoft WPA Supplicant understands. This is only tried after the four-way handshake has failed once so that other Supplicants that work according to the specification can operate in this mode. 
 
 This workaround may currently only work with WPA-PSK. 
 
 By default, the workaround is disabled (wpa_tkip_ccmp_workaround=1) 
 
 To enable it: 
wpa_tkip_ccmp_workaround=1
   
 Microsoft Windows XP WPA Supplicant Workaround for EAPOL-Start Frames 
 
 Microsoft WPA Supplicant seems to use unencrypted EAPOL-Start frame to request new negotiation even when WPA Pairwise keys are set (and even with WPA-PSK). This workaround allows these frames to be received (they would be dropped otherwise because WPA is supposed to encrypt these frames when pairwise keys are set and WPA-PSK should not use EAPOL-Start). This behavior seems to be triggered both by using 'Connect' button on the wireless network connection dialog box and by changing network configuration in the WinXP zeroconf. 
 
 This workaround makes it possible for unauthorized users to restart WPA negotiation with unencrypted EAPOL-Start packet; however, since they can do this anyway with unencrypted deauthentication frame, this does not make denial of service attacks easier. 
 
 By default, this workaround is enabled: 
wpa_plaintext_eapol_start_workaround=1
   
 IEEE 802.11i/RSN/WPA2 Preauthentication 
 
 Enable IEEE 802.11i/RSN/WPA2 pre-authentication. This is used to speed up roaming by pre-authenticating IEEE 802.1X/EAP part of the full RSN authentication and key handshake before actually associating with a new AP. 
 
 By default, this option is disabled (0). 
 
 To enable it: 
rsn_preauth=1
   
 Provide a space separated list of interfaces from which pre-authentication frames are accepted (for example, 'eth0' or 'eth0 wlan0wds0'. This list should include all interfaces used for connections to other APs. This could include wired interfaces and WDS links. The normal wireless data interface towards associated stations (for example, wlan0) should not be added, since pre-authentication is only used with APs other than the currently associated one. 
rsn_preauth_interfaces=eth0
   
 WPA Poll Interval 
 
 The WPA poll interval can be used to configure a periodic poll in which the AP sends the current group key as a new group key update to the STA and verifies that a reply is received. If no reply is received, the STA will be deauthenticated. This functionality is a workaround to recover automatically from cases where the encrypted data connection breaks but the STA remains associated. 
 
 By default, this option is disabled (wpa_poll_interval=0). 
 
 The poll interval is specified in seconds. As an example, this sets the poll interval to 60 seconds (1 minute): 
wpa_poll_interval=60
   
 Broadcast SSID Setting 
 
 When this configuration item is set, the access point sends an empty SSID in its beacons. It also ignores probe request frames that do not specify the full SSID-it requires stations to know the SSID (0 = include SSID in beacon frames and reply to Probe Requests for broadcast SSID ("any") or 1 = send empty SSID in beacon frames and only reply to Probe Requests that specify the full SSID). 
ignore_broadcast_ssid=1
   
 Station Isolation 
 
 When IEEE 802.11 is used in managed mode, packets are usually send through the AP even if they are from a wireless station to another wireless station. This functionality requires that the AP has a bridge functionality that sends frames back to the same interface if their destination is another associated station. In addition, broadcast/multicast frames from wireless stations will be sent both to the host system net stack (eventually to the wired network) and back to the wireless interface. 
 
 The internal bridge is implemented within the wireless kernel module and it bypasses kernel filtering (netfilter/iptables/ebtables). If direct communication between the stations needs to be prevented, the internal bridge can be disabled by setting bridge_packets=0.
 
 Note 
   
 If this variable is not included in hostapd.conf, hostapd does not change the configuration and iwpriv can be used to set the value with 'iwpriv wlan# param 10 0' command. If the variable is in hostapd.conf, hostapd will override possible iwpriv configuration whenever configuration file is reloaded. 
 
 You can enable or disable internal bridge for packets between associated stations 
 
 Station Isolation On (Disabling the Internal Bridge) 
 
 Disabling the internal bridge in effect turns "station isolation" on: 
bridge_packets=0
   
 In this mode, the access point blocks communication between wireless clients. Data traffic is still allowed between the AP and its wireless clients and wired devices on the network, but not among wireless clients. The traffic blocking extends to wireless clients connected to the network via WDS links; these clients cannot communicate with each other when Station Isolation is on. 
 
 Station Isolation Off (Default Setting) 
 
 By default, station isolation is off; that is, bridge packets are not controlled from hostapd (80211.o defaults to 1=enabled) 
bridge_packets=1
   
 Security Policy 
 
 Use the security_policy configuration item to define the security for secondary SSIDs in a multi-SSID configuration. Similarly, use wds_security_policy to configure WDS links.
 
 Note 
   
 Do not use security_policy to configure the primary, "beaconing" SSID. That is, if you are configuring a single-SSID network do not use this configuration item. 
 
0 
   
 Plain text (No WEP encryption. This is the default.) 
   
   
1 
   
 Static WEP key (multi_wep_default_key and multi_wep_key[0..3] are needed in this block) 
   
 See also Static WEP Security. 
   
2 
   
 IEEE 802.1X (WEP keying, non-WPA) 
   
 See also 802.1X Security. 
   
3 
   
 WPA-PSK (multi_wpa_psk_ascii or multi_wpa_psk_hex are needed in this block) 
   
 See also: 
 
Wi-Fi Protected Access
 
WPA-PSK
   
4 
   
 WPA (with IEEE 802.1X authentication) 
   
 See also: 
 
Wi-Fi Protected Access
 
IEEE 802.11i/RSN/WPA2 Preauthentication
 
 An example of setting the Security policy to Static WEP: 
security_policy=1
   
 
 Note 
   
For all but "Plain Text" mode (0) which requires no additional configuration, the security_policy setting must be used in conjunction with other configuration options based on which type of security you want to configure. For example, if you want to configure Static WEP you must set security_policy to "1" and also configure the WEP keys as described in the section on Static WEP.
 
See Multiple SSID and BSSID for information on configuring security for multi SSIDs.
 
See Wireless Distribution System (WDS) for information about configuring security for a WDS link.
 
 Quality of Service Queues 
  
 Quality of Service (QoS) provides you with the ability to specify parameters on multiple queues for increased throughput and better performance of differentiated wireless traffic like Voice-over-IP (VoIP), other types of audio, video, and streaming media as well as traditional IP data. QoS is achieved by using transmission queues with different priority levels for different types of data. For example, the more time-sensitive VoIP traffic would experience minimum delay and have a higher priority than bulk data. 
 
hostapd can be configured to support QoS queues as defined in the draft 802.11e standard. This consists of configuring the following sets of parameters: 
 
AP Enhanced Distributed Channel Access (EDCA) parameters prioritize transmit wait times for different types of traffic flowing from the access point to the client station (AP-to-STA traffic).
 
Station Enhanced Distributed Channel Access (EDCA) Parameters prioritize transmit wait times for traffic flowing from the client station to the access point (STA-to-AP traffic).
 
 A higher-priority queue has a shorter Arbitration Interframe Space (AIFS) than a lower-priority queue, giving data in high-priority queues immediate access to the medium. 
 
 The following sections are included here: 
 
Default
 
Syntax
 
Queues
 
Parameters
 
Default QoS Parameters for Access Point (AP-to-STA Traffic)
 
Enabling/Disabling Wi-Fi Multimedia (WMM)
 
IEEE 802.1D Tag to Access Category Mappings
 
Default QoS Parameters for Clients (STA-to-AP Traffic)
 
 Default 
 
 The default for all these fields is that they are not set; by default, the device will use its hardware defaults. 
 
 Syntax 
 
 The syntax for setting a parameter on a queue is: tx_queue_<queue name>_<param>. The tables in "Queues" and "Parameters" sections below describe <queue_name> and <param> and possible values for each. 
 
 Queues 
 
 The current implementation consists of the following transmission queues:
 
 <queue_name> 
 
 Description 
 
data0 
   
Voice. Highest priority queue, minimum delay. Time-sensitive data such as VoIP and streaming media are automatically sent to this queue. 
   
data1 
   
Video. High priority queue, minimum delay. Time-sensitive video data is automatically sent to this queue. 
   
data2 
   
Best Effort. Normal priority queue, medium throughput and delay. Most traditional IP data is sent to this queue. 
   
data3 
   
Background. Lowest priority of the configurable queues (in terms of wait times), high throughput. Bulk data that requires maximum throughput and is not time-sensitive is sent to this queue (FTP data, for example). 
   
after_beacon 
   
 Special queue; not normally configurable. 
   
beacon 
   
 Special queue; not normally configurable. 
 
 Parameters 
 
 Each queue has a set of parameters. These include:
 
 <param> 
 
 Description 
 
aifs 
   
 The Arbitration Inter-Frame Spacing (aifs) specifies a wait time (in milliseconds) for data frames. Valid values for aifs are 1 through 255. 
 
 The default is 2. 
   
cwmin 
   
 Minimum Contention Window 
 
 This parameter is input to the algorithm that determines the initial random backoff wait time ("window") for retry of a transmission. The value specified for cwmin is the upper limit (in milliseconds) of a range from which the initial random backoff wait time is determined. 
 
 The first random number generated will be a number between 0 and the number specified here. 
 
 If the first random backoff wait time expires before the data frame is sent, a retry counter is incremented and the random backoff value (window) is doubled. Doubling will continue until the size of the random backoff value reaches the number defined for cwmax. 
 
 Valid values for the cwmin are 1, 3, 7, 15, 31, 63, 127, 255, 511, or 1023. The value for cwmin must be lower than the value for "cwmax". (cwmin < cwmax) 
   
cwmax 
   
 Maximum Contention Window 
 
 The value specified in cwmax is the upper limit (in milliseconds) for the doubling of the random backoff value. This doubling continues until either the data frame is sent or the cwmax size is reached. 
 
 Once cwmax size is reached, retries will continue until a maximum number of retries allowed is reached. 
 
 Valid values for the cwmax are 1, 3, 7, 15, 31, 63, 127, 255, 511, or 1023. The value for cwmax must be greater than or equal to the value for "cwmin". (cwmax >= cwmin) 
   
burst 
   
 AP EDCA Parameter Only (The burst length applies only to traffic flowing from the AP to the STA.) 
 
 This value specifies (in milliseconds with precision of up to 0.1 ms) the maximum burst length allowed for packet bursts on the wireless network. A packet burst is a collection of multiple frames transmitted without header information. The decreased overhead results in higher throughput and better performance. 
 
 Valid values for maximum burst length are 0.0 through 999 
 
 Default QoS Parameters for Access Point (AP-to-STA Traffic)
 
 Note 
   
 The values provided in the default configuration have been optimized to the draft 802.11e standard. It is recommended that you use these values. 
 
 These parameters are used by the access point when transmitting frames (AP-to-STA traffic): 
 
 Low priority / AC_BK = background 
tx_queue_data3_aifs=7
  
tx_queue_data3_cwmin=15
  
tx_queue_data3_cwmax=1023
  
tx_queue_data3_burst=0
   
 (For IEEE 802.11b mode: cwmin=31 cwmax=1023 burst=0) 
 
 Normal priority / AC_BE = best effort 
tx_queue_data2_aifs=3
  
tx_queue_data2_cwmin=15
  
tx_queue_data2_cwmax=63
  
tx_queue_data2_burst=0
   
 (For IEEE 802.11b mode: cwmin=31 cwmax=127 burst=0) 
 
 High priority / AC_VI = video 
tx_queue_data1_aifs=1
  
tx_queue_data1_cwmin=7
  
tx_queue_data1_cwmax=15
  
tx_queue_data1_burst=3.0
   
 (For IEEE 802.11b mode: cwmin=15 cwmax=31 burst=6.0) 
 
 Highest priority / AC_VO = voice 
tx_queue_data0_aifs=1
  
tx_queue_data0_cwmin=3
  
tx_queue_data0_cwmax=7
  
tx_queue_data0_burst=1.5
   
 (For IEEE 802.11b mode: cwmin=7 cwmax=15 burst=3.3) 
 
 Special queues; normally not user configurable 
tx_queue_after_beacon_aifs=2
  
tx_queue_after_beacon_cwmin=15
  
tx_queue_after_beacon_cwmax=1023
  
tx_queue_after_beacon_burst=0
  
tx_queue_beacon_aifs=2
  
tx_queue_beacon_cwmin=3
  
tx_queue_beacon_cwmax=7
  
tx_queue_beacon_burst=1.5
   
 Enabling/Disabling Wi-Fi Multimedia (WMM) 
 
 By default, Wi-Fi MultiMedia (WMM, formerly WME) is enabled on the access point. With WMM enabled, QoS prioritization and coordination of wireless medium access is on. With WME enabled, QoS settings on the AP control downstream traffic flowing from the access point to client station and the upstream traffic flowing from the station to the AP. 
 
 Disabling WMM will deactivate QoS control of station parameters on upstream traffic flowing from the station to the AP. 
 
 With WME disabled, you can still set some parameters on the downstream traffic flowing from the access point to the client station (AP EDCA parameters). 
 
 The default is to have WMM enabled: 
wme_enabled=1
   
 IEEE 802.1D Tag to Access Category Mappings 
 
 Wi-Fi MultiMedia (WMM) specifies following mapping of data frames to different access categories (ACs). This mapping can be configured using Linux QoS/tc and sch_pktpri.o module. When WMM is enabled, standard tags and categories are communicated over the network among APs and clients.
 
 IEEE 802.1D Tag 
 
 IEEE 802.1D 
Designation 
 
 Access Category 
 
 WMM Designation 
 
1 
   
 BK 
   
 AC_BK 
   
 Background 
   
2 
      
 AC_BK 
   
 Background 
   
0 
   
 BE 
   
 AC_BE 
   
 Best Effort 
   
3 
   
 EE 
   
 AC_VI 
   
 Video 
   
 4 
   
 CL 
   
 AC_VI 
   
 Video 
   
 5 
   
 VI 
   
 AC_VI 
   
 Video 
   
 6 
   
 VO 
   
 AC_VO 
   
 Voice 
   
 7 
   
 NC 
   
 AC_VO 
   
 Voice 
 
 Data frames with no priority information have an Access Category of AC_BE 
 
 Management frames have an Access Category of AC_VO 
 
 PS-Poll frames have an Access Category of AC_BE 
 
 Default QoS Parameters for Clients (STA-to-AP Traffic) 
 
 These parameters are sent to WMM clients when they associate. These parameters will be used by WMM clients for frames transmitted to the access point (STA-to-AP traffic) on IEEE 802.11a and IEEE 802.11g networks.
 
 Notes 
   
txop_limit is in units of 32microseconds
 
acm is admission control mandatory flag where 0 = admission control not required and 1 = mandatory
 
In the configuration settings shown below, cwMin and cmMax are indicated in exponent form. The actual cw value used will be (2^n)-1 where n is the value given here
 
Atheros SuperA/G uses only the AC_BE (best effort) category for client configuration. Other catagories will be ignored, so only wme_ac_be_* variables need to be set if full WMM is not used.
  
 
 Low Priority / AC_BK = background 
wme_ac_bk_cwmin=4
  
wme_ac_bk_cwmax=10
  
wme_ac_bk_aifs=7
  
wme_ac_bk_txop_limit=0
  
wme_ac_bk_acm=0
   
 (For IEEE 802.11b mode: cwmin=5 cwmax=10) 
 
 Normal priority / AC_BE = best effort 
wme_ac_be_aifs=3
  
wme_ac_be_cwmin=4
  
wme_ac_be_cwmax=10
  
wme_ac_be_txop_limit=0
  
wme_ac_be_acm=0
   
 (For IEEE 802.11b mode: cwmin=5 cwmax=7) 
 
 High priority / AC_VI = video 
wme_ac_vi_aifs=2
  
wme_ac_vi_cwmin=3
  
wme_ac_vi_cwmax=4
  
wme_ac_vi_txop_limit=94
  
wme_ac_vi_acm=0
   
 (For IEEE 802.11b mode: cwmin=4 cwmax=5 txop_limit=188) 
 
 Highest priority / AC_VO = voice 
wme_ac_vo_aifs=2
  
wme_ac_vo_cwmin=2
  
wme_ac_vo_cwmax=3
  
wme_ac_vo_txop_limit=47
  
wme_ac_vo_acm=0
   
 (For IEEE 802.11b mode: cwmin=3 cwmax=4 burst=102) 
 
 Rogue Detection 
  
hostapd uses passive scanning to locate other Access Points. This feature is provided as part of rogue detection, but can also be used for WDS and clustering. 
 
 Set the passive scanning mode (0 = scan all supported modes, 1 = only scan the currently used mode): 
passive_scan_mode=1
   
 Set the scan of the different channels every passive_scan_interval seconds (0 = disable passive scanning): 
passive_scan_interval=60
   
 Set the length of time (in ?secs) to listen on each channel when doing passive scanning. This values plus the time needed for changing channels should be less than 32 milliseconds (32,000 ?sec) to avoid interruptioning normal operations. The time needed for changing channels varies depending on the WLAN hardware being used: 
passive_scan_listen=10000
   
 Set the maximum number of entries kept in the passive scanning results table. The oldest entry will be removed when adding a new entry that would make the list grow over this limit: 
ap_table_max_size=255
   
 Set the number of seconds of receiving no frames from an Access Point before deleting its entry from the Access Point table. Since passive scanning is usually not performed frequently, this should be set to a reasonable value. In addition, there is no guarantee that every scan cycle will receive beacon frames from neighboring Access Points. 
ap_table_expiration_time=3600
   
 Layer 2 Update of Station Association (IAPP) 
  
hostapd provides support for Layer 2 Update frames to update bridge learn tables when a station associates. The updates are sent via the iapp_interface (despite the name, "IAPP" is not the focus here), so if you want to enable Layer 2 updates you must first define the iapp_interface configuration item to specify the interface used for the broadcast packets: 
iapp_interface=eth0
   
 The layer2_update configuration item tells hostapd to use an LLC Update response frame so that 802.2 devices (such as bridges, switches and other Access Points) can update their forwarding tables when a station successfully associates. The default is "0" (disabled). 
 
 To enable Layer 2 updates first make sure you have defined the iapp_interface, then set layer2_update to "1" (enabled): 
layer2_update=1
   
 
 Note 
   
IEEE 802.11f is not supported in this release. The iapp_interface configuration element is used only to specify the interface for broadcast packets for OSI layer 2 updates as described above. 
 
 Wireless Distribution System (WDS)
 
 
 Note 
   
 For the Broadcom driver, WDS must be configured in that driver using the Broadcom wl tools. For information on how to configure these features in the Broadcom driver see hostapd.conf Options Requiring External Configuration with Broadcom wl and broadcom-wl package. 
 
 
 IEEE 802.11 specifies a method for using wireless connection as a distribution system. A Wireless Distribution System (WDS) is a technology that wirelessly connects access points, Basic Service Sets (BSS), to form what is an Extended Service Set (ESS). In an ESS (a network of multiple access points) each access point serves part of an area which is too large for a single access point to cover. You can use WDS to bridge distant Ethernets to create a single LAN, or to extend the reach of the network into areas where cabling would be too difficult, costly, or inefficient. 
 
 Each WDS link needs one interface and can have a set of static WEP keys associated with it. Multiple interfaces are configured by repeating the WDS block with the same field names as in the example below. 
 
802.11 specifies a method for using wireless connection as a distribution system. Each WDS link needs one interface and can have a set of static WEP keys associated with it. (The optional Static WEP key configuration can be 40/104/128-bit keys; as hexidecimal or string.) 
wds=wlan0wds0
  
wds_remote_addr=00:02:03:04:05:06
  
wds_wep_key=123456789a
   
 Multiple interfaces are configured by repeating the WDS block with the same field names as in the following example: 
wds=wlan0wds1
  
wds_remote_addr=00:22:22:22:22:22
  
wds_wep_key="abcde"
  
wds=wlan0wds2
  
wds_remote_addr=00:33:33:33:33:33
   
 Details and examples of WDS configuration are provided below: 
 
WDS SSID
 
WDS Security Policy
 
WDS Endpoint State
 
WDS Association
 
WDS Configuration Example
 
 WDS SSID 
 
 The "wds_ssid"s is the SSID used by the WDS links are are not included in the beacon frames. The WDS end points shoud explicitly associate to this SSID. Each WDS link should have its own SSID configured. The SSID configuration is only needed to support WPA or association based WEP support. 
wds_ssid=wlan0wds0-ssid
   
 WDS Security Policy 
 
 You can specify the following security policies to be used on the WDS link.
 
 Note 
   
 The security configured with these options is specific to the WDS link, and does not constitute security for the Access Point primary SSID. For information on standard security settings on the AP, see Security. For information on security settings on multi-SSID configurations, see Multiple SSID and BSSID. 
 
 Use the wds_security_policy configuration item to define the security for this SSID on the WDS link.
 
0 
   
 Plain text (No WEP encryption. This is the default.) 
   
1 
   
 Static WEP key (wds_wep_key) 
   
3 
   
 WPA-PSK (wds_wpa_psk_ascii or wds_wpa_psk_hex are needed in this block) 
 
 An example of setting the security for a WDS link to WPA-PSK: 
wds_security_policy=3
   
 The above mentioned security polices are supported for the WDS links. However, there are some restrictions in configuring the WDS security policy: 
 
If auth_algs of the bss is set to 2 (only Shared Key Authentication), all WDS SSIDs must use static WEP key. That is, the primary SSID must have wep_* defined, and any wds_ssids must have wds_security_policy=1 (and have wds_wep_key defined).
 
If the primary SSID is using plain text, then any "wds_ssid"s must also use plain text (that is, have wds_security_policy=0).
 
If the primary SSID is not using plain text, then no wds_ssids can use plain text (that is, they may not have wds_security_policy=0).
 
If the primary SSID is not using WPA (WPA-RADIUS or WPA-PSK), then no wds_ssids can use WPA (that is, they may not have wds_security_policy=3).
 
 WDS Endpoint State 
 
 Each WDS endpoint can act as either an Access Point or Station to complete the association. Logically, the endpoint which has connectivity to the wired network would be the AP, but this can also be reversed. wds_ap can be set to 1/0 to make this WDS link act as AP/STA. It is required to set one end as an AP and the other as STA to successfully bring up the WDS link. 
wds_ap=1
   
 WDS Association 
 
 This option is mainly provided to make it interoperable with other solutions available. WDS links can be established without the actual association between the end points. This can be achieved by setting this field to 0. (The default is "1".) 
wds_assoc=1
   
 WDS Configuration Example 
 
 Following is an example of configuring a WDS link between two APs. 
wds=wlan0wds0
  
wds_remote_addr=00:11:11:11:11:11
  
wds_ssid=wds-ssid
  
wds_security_policy=3
  
wds_wpa_psk_ascii=12345678
  
wds_ap=1
  
wds_assoc=1
  
wds=wlan0wds4
  
wds_remote_addr=00:44:44:44:44:44
  
wds_ssid=wds-ssid
  
wds_security_policy=1
  
wds_wep_key="abcde"
  
wds_ap=1
  
wds_assoc=1
  
wds=wlan0wds1
  
wds_remote_addr=00:22:22:22:22:22
  
wds_wep_key="abcde"
  
wds=wlan0wds2
  
wds_remote_addr=00:33:33:33:33:33
   
 Load Balancing 
  
 The load balancing features attempt to maintain a usable amount of throughput for a particular channel. hostapd disassociates stations if a given channel is overloaded. 
 
 Load balancing is disabled by default (load_balance_threshold=0) 
 
 The load balancing feature is enabled with the load_balance_threshold configuration item: 
load_balance_threshold=80
   
 The utilization threshold is reported in percentage. If the air time related load is greater than the given threshold, disassociate a station. Stations that are sleeping in power-save mode are disassociated first. 
 
 If the associated stations is lower than the value defined with the load_balance_threshold_st configuration item, do not disassociate any stations: 
load_balance_threshold_st=4
   
 If the air time utilization percentage is higher than the limit defined with load_balance_assoc_limit, new stations are not allowed to associate with this interface of the Access Point. Setting this value to zero or removing it from configuration file disables the limit. 
 
 This feature can be used only if load_balance_threshold is also defined. 
load_balance_assoc_limit=80
   
 Rate Limit 
  
hostapd can limit the rate of broadcast and multicast packets transmitted by a wireless interface. 
 
 The rate limit is disabled by default (rate_limit=0). 
 
 Enable the rate limit with the rate_limit configuration item. It controls the number of packets per second transmitted. A recommended range is 0 to 1000 packets per second: 
rate_limit=50
   
 In addition, you can set rate_limit_burst, which controls the number of packets allowed in a burst before actually starting to drop broadcast frames. rate_limit_burst should be greater than or equal to rate_limit: 
rate_limit_burst=75
   
 Multiple SSID and BSSID 
 
 
Multiple SSID
 
Multiple BSSID
 
 Multiple SSID 
 
hostapd supports multiple SSIDs. The SSID configured above (using the ssid configuration item) is the default SSID for the Access Point and the only one included in its Beacon frames. However, the hostapd supports other SSIDs when its stations are configured to explicitly associate with these. 
 
 A multiple SSID is defined with the multi_ssid configuration item: 
multi_ssid=GuestAccess
   
 Use the security_policy configuration item to define the security for this SSID:.
 
0 
   
 Plain text (No WEP encryption. This is the default.) 
   
1 
   
 Static WEP key (multi_wep_default_key and multi_wep_key[0..3] are needed in this block) 
   
2 
   
 IEEE 802.1X (WEP keying, non-WPA) 
   
3 
   
 WPA-PSK (multi_wpa_psk_ascii or multi_wpa_psk_hex are needed in this block) 
   
4 
   
 WPA (with IEEE 802.1X authentication) 
 
 An example of setting the Security policy to Static WEP: 
security_policy=1
   
 If the vlan configuration item is set, the given interface is added by the kernel driver. The SSID and security_policy are bound to this interface: 
vlan=wlan0_wep
   
 If vlan is not set, the default interface, wlan0, is used.
 
 Note 
   
 Multiple entries in this can share the same SSID or vlan name, but there are some limitations on which combinations can be used with the same SSID. Using unique SSID for each entry is the easiest way of making the configuration valid. You can also use mixed mode of 802.1x and WPA stations with the same SSID. Examples of invalid configurations: WPA and WPA-PSK using same SSID, plaintext and static WEP or multiple static WEP entries using same SSID. 
 
 Notes On Security Configuration for Multiple SSIDs 
 
 While hostapd will permit any security_policy to be specified for any multi_ssid, there are some restrictions that should be followed to ensure client interoperability: 
 
If auth_algs of the bss is set to 2 (only Shared Key Authentication), all SSIDs must use static WEP key. That is, the primary SSID must have wep_* defined, and any multi_ssids must have security_policy=1 (and have multi_wep* defined).
 
If the primary SSID is using plain text, then any multi_ssids must also use plain text (security_policy=0).
 
If the primary SSID is not using plain text, then no multi_ssids can use plain text (that is, they may not have security_policy=0.
 
If the primary SSID is not using WPA (WPA-RADIUS or WPA-PSK), then no multi_ssids can use WPA (that is, they may not have security_policy=3 or security_policy=4).
 
 Specific clients (for example, those from Cisco) do not require all of these restrictions, and using such settings can be useful with those clients. 
 
 Example Configurations 
multi_ssid=open net
  
security_policy=0
  
multi_ssid=wep net
  
vlan=wlan0_wep
  
security_policy=1
  
multi_wep_default_key=0
  
multi_wep_key0="abcde"
  
multi_ssid=802.1X net
  
vlan=wlan0_1x
  
security_policy=2
  
multi_wep_default_len=5
  
multi_ssid=WPA-PSK net 1
  
vlan=wlan0_wpapsk1
  
security_policy=3
  
multi_wpa_psk_ascii=12345678
  
multi_ssid=WPA-PSK net 2
  
vlan=wlan0_wpapsk2
  
security_policy=3
  
multi_wpa_psk_hex=0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF012345678
9ABCDEF
  
multi_ssid=WPA net
  
vlan=wlan0_wpa
  
security_policy=4
   
 Multiple BSSID 
 
hostapd enables multiple BSSIDs by the addition of a bss configuration item. The bss item requires a default interface name to be allocated for the data packets of the new BSS: 
bss=wlan0_0
   
 Once a new BSS is configured with the bss configuration item, most of the configuration items listed in this section can be explicitly customized. The main exception is radio interface specific items, such as channel. 
 
hostapd generates a BSSID mask based on how many BSSes are configured. It verifies that dev_addr & MASK == dev_addr. If this is not the case, the MAC address of the radio must be changed before starting hostapd with the command ifconfig wlan0 hw ether MAC_addr.
 
 Note 
   
hostapd uses some of the values configured for the first BSS as defaults for all subsequent BSSes. However, it is recommended that all BSSes include explicit configuration of all relevant configuration items. 
 
 A BSSID is assigned in order to each BSS: 
bss=wlan0_0
  
ssid=testLAN00
  
...
  
bss=wlan0_1
  
ssid=testLAN01
  
...
   
 Example hostapd.conf Configuration Files 
  
 Example 1. Minimal Configuration 
# Minimal configuration file
  
interface=wlan0
  
ssid=test
  
channel_policy=1
   
 Example 2. Simple Configuration for Plain Text AP 
# Simple configuration file for plaintext AP
  
interface=wlan0
  
ssid=plaintext
  
channel_policy=0
  
hw_mode=a
  
channel=48
  
beacon_int=100
   
 Example 3. WPA Security Configuration Example 
# IEEE 802.1X with dynamic WEP rekeying
  
interface=wlan0
  
ssid=IEEE 802.1X with WEP rekeying
  
channel_policy=0
  
hw_mode=g
  
channel=11
  
beacon_int=100
  
wep_key_len_broadcast=13
  
wep_key_len_unicast=13
  
wep_rekey_period=300
  
ieee8021x=1
  
framed_mtu=1400
  
own_ip_addr=192.168.10.10
  
auth_server_addr=192.168.10.2
  
auth_server_port=1812
  
auth_server_shared_secret=secret
   
 External APIs 
 
 
HostAPd Control and Monitoring API Functions
 
Wrapper Functions
 
API Command Line Interface
 
 HostAPd Control and Monitoring API Functions 
 
 The Host Access Point Daemon, hostapd, provides a datagram API for control and monitoring of the daemon. It is used to retrieve SNMP data from an Access Point or execute specific commands and can be extended to acquire other information. 
 
 Include the datagram API functions with the following header: 
#include "hostapd_api.h"
   
 API Connect 
 
 The hostapd_api_connect() function creates an abstract socket connection to the given interface: 
int hostapd_api_connect(const char *iface)
   
 API Command 
 
 The hostapd_api_cmd() function performs the given hostapd command and receives the reply. It passes the file descriptor number for the abstract socket opened with hostapd_api_connect(), a NULL-terminated API command string, a pointer to response buffer, the length of the response buffer, and a time-out in seconds for the API call. It returns the length of the response in the response buffer or a negative value on error: 
int hostapd_api_cmd(int s, const char *cmd, char *buf, size_t buflen, int 
timeout)
   
 API Close 
 
 The hostapd_api_close() function closes the connection to hostapd. It passes the file descriptor number for the abstract socket opened with hostapd_api_connect(). 
int hostapd_api_close(int s)
   
 Wrapper Functions 
 
 SNMP Table 
 
 The hostapd_sget() function retrieves the SNMP table information for all interfaces supported by hostapd. It passes the ID of the SNMP table to be retrieved, a pointer to response buffer, and the length of the response buffer. It returns the length of the response in the response buffer or a negative value on error: 
int hostapd_sget(int table, char *buf, int buf_len)
   
 The supported SNMP tables are provided as #define in the header file: 
 
hapd_dot11StationConfigTable 
 
hapd_dot11AuthenticationAlgorithmsTable 
 
hapd_dot11OperationTable 
 
hapd_dot11CountersTable 
 
hapd_dot11resAttribute 
 
hapd_dot11PhyOperationTable 
 
 For example: 
hostapd_sget(hapd_dot11AuthenticationAlgorithmsTable, buf, 1024);
   
 Datagram Command 
 
 The hostapd_get() function passes a command to hostapd, a pointer to response buffer, and the length of the response buffer. It returns the length of the response in the response buffer or a negative value on error: 
int hostapd_get(char *cmd, char *buf, int buf_len)
   
 This function accepts the same Commands as listed for the apicli command below. For example: 
len = hostapd_get("disassoc wlan0 0:0c:41:0a:21:a4 3", char *buf, int 
buf_len);
   
 API Command Line Interface 
 
 The apicli command provides per radio interface commands. Its syntax is as follows: 
apicli server_name COMMAND
   
 Values for server_name: hostapd-all (all interfaces), hostapd-wlan0, hostapd-wlan1, etc. 
 
 If the server_name is hostapd-all, it accepts the commands 'snmpget #' and PING. 
 
 If the server_name is hostapd-wlan# (where # is 0, 1, etc.), it accepts the commands AP_TABLE, AP-<hwaddr>, AP-FIRST, AP-NEXT-<prev_hwaddr>, AP-NEW, PING. RELOAD, STATIONS, STATION-<hwaddr>, STATION-FIRST, and STATION-NEXT-<prev_hwaddr>. 
 
 Examples: 
apicli hostapd-wlan0 STATS
  
apicli hostapd-all 'snmpget 1'
   
 Commands 
 
 AP-<hwaddr> 
 
 AP-FIRST 
 
 AP-NEXT-<prev_hwaddr> 
 
 AP-NEW 
 
AP-<hwaddr> returns the entry for a specific Access Point. AP-FIRST returns the entry for the first Access Point in the table. AP-NEXT-<prev_hwaddr> returns the entry for the Access Point following the given Access Point (this is used to iterate through the Access Point table). AP-NEW returns the entry for an Access Point that has not been "seen" before (AP-NEW will show every one once)-if there are no new Access Points, an empty message is returned. 
 
 The above commands return the following fields, separated by tabs: 
 
Address
 
Beacon Interval
 
Capability
 
SSID
 
WPA
 
PHY Type
 
Channel
 
Rate
 
Signal
 
ERP
 
Number of Received Beacons
 
Timestamp of Last Beacon
 
Supported Rate Set
 
 PING 
 
 Asks if hostapd is running. Returns PONG on success. 
 
 RELOAD 
 
 Reloads hostapd.conf for the selected interface. Returns OK on success. 
 
 STATION-<hwaddr> 
 
 STATION-FIRST 
 
 STATION-NEXT-<prev_hwaddr> 
 
STATION-<hwaddr> returns the station entry for a specific station. STATION-FIRST returns the station entry for the first station in the table. STATION-NEXT-<prev_hwaddr> returns the entry for the station following the given station (this is used to iterate through the station table). 
 
 The above commands return the following fields, separated by tabs: 
 
Address
 
Flags
 
RX Packets
 
TX Packets
 
RX Bytes
 
TX bytes
 
Current TX Rate
In 100 kbps (540 = 54 Mbps)
 
Listen Interval
 
Association ID
 
Failure Reason
See enum sta_failure_reason comments in hostapd/ap.h for a complete list of possible values.
 
 STATS 
 
 Returns the following fields, separated by tabs: 
 
Number of Stations
 
Percentage of Channel Utilization
This is used only if load balancing is enabled.
 
 Debugging 
  
 During development, you may need debugging messages from hostapd. You can set the level of debugging supported. The options are: 
 
debug=0 (no debugging, the default)
 
debug=1 (minimal debugging)
 
debug=2 (verbose debugging)
 
debug=3 (message dumps)
 
 The debug messages are always written to stdout (as the output of the hostapd process) and hostapd must not be set to fork into background for this to work. 
 
 See also Event Logging for additional event messages which can provide more debugging information. 
 
 You can also define a dump file hostapd will use to save its messages. 
dump_file=/tmp/hostapd.dump
   
 If the dump_file is set, sending SIGUSR1 to hostapd process will dump current STA table data to the configured file. This is a text file including all STAs and their IEEE 802.11, IEEE 802.1X, and WPA state. 
 
 Building the Package 
  
 Follow standard instructions for building userspace packages in the Devicescape Developer Guide topic on "Building the Packages", see subtopic: "Building a Userspace Package from a Source RPM" 
 
 Licensing 
  
BSD 
 
 Devicescape Software, Inc. 
 
 Related Packages
 
 
 Note 
   
 When using hostapd with the Devicescape reference designs (which use the Atheros driver), do not use wireless-tools to configure parameters that are set in the hostapd.conf file. For information on compatibility issues, see When to Use wireless-tools or ieee80211 Packages in wireless-tools package. 
 
 Required 
 
 ds-wireless-ap package (see Quick View of All Packages) 
 
ieee80211 package 
 
 Suggested 
 
 None 
Package GuidePreviousNextIndex 
   

 
footer   2006 Devicescape Software, Inc. - Sitemap - BLOG     Contact Sales sales@devicescape.com or call +1.650.829.2600
 