IWEVENT(8)

💖 IWEVENT(8) 💖

okay bestie, welcome to iwevent — part of the Linux Programmer's Manual, and literally one of my fave lil tools for snooping on what your wireless hardware is doing behind your back. no cap.

✨ NAME ✨

iwevent — displays Wireless Events generated by drivers and setting changes 💅

🎀 SYNOPSIS 🎀

iwevent

🌸 DESCRIPTION 🌸

so iwevent shows you Wireless Events that come in through the RTNetlink socket. every single line is one specific Wireless Event telling you what just happened on the wireless interface it names. it's giving live commentary for your WiFi card. 👑

and the best part? this command doesn't take any arguments. you just run it. periodt.

🦋 DISPLAY 🦋

okay so there are two classes of Wireless Events. two whole flavors. let's get into it.

1️⃣ first class: setting changes

these are events about a change of wireless settings on the interface — usually done through iwconfig, or a script that calls iwconfig. sneaky scripts, love that for them.

but here's the thing, bestie: only settings that could result in a disruption of connectivity are reported. so it's not gonna spam you about every tiny thing. the events currently reported are a change of one of the following settings:

• Network ID
• ESSID
• Frequency
• Mode
• Encryption

all of those events get generated on all wireless interfaces by the kernel wireless subsystem — but only if the driver has been converted to the new driver API. old drivers? they're not invited to this party, sorry. 💀

2️⃣ second class: hardware events

the second class is events generated by the hardware, when something happens or a task has been finished. these include:

• New Access Point/Cell address — the interface has joined a new Access Point or Ad-Hoc Cell, or lost its association with it. this is the same address that iwconfig reports. 🫶
• Scan request completed — a scanning request has been completed and the results of the scan are available (see iwlist). go look at your lil scan results, you earned them.
• Tx packet dropped — a packet directed at this address got dropped because the interface believes this node doesn't answer anymore (usually maximum of MAC level retry exceeded). usually this is an early heads-up that the node may have left the cell or gone out of range, but ngl it may also just be fading or excessive contention. not always drama, sometimes just vibes. 😭
• Custom driver event — an event specific to the driver. please check the driver documentation, because I literally cannot help you here. 🙈
• Registered node — the interface has successfully registered a new wireless client/peer. will be generated mostly when the interface acts as an Access Point (mode Master). iconic behavior.
• Expired node — the registration of the client/peer on this interface has expired. will be generated mostly when the interface acts as an Access Point (mode Master). it's giving ghosted. 💀
• Spy threshold crossed — the signal strength for one of the addresses in the spy list went under the low threshold or went above the high threshold. spy list said 👀

ngl most wireless drivers generate only a subset of those events, not all of them. the exact list depends on the specific hardware/driver combination. so if you're not seeing something, it's not you, it's the driver. please refer to driver documentation for details on when they are generated, and use iwlist(8) to check what the driver actually supports. 💅

👑 AUTHOR 👑

Jean Tourrilhes - jt@hpl.hp.com

🌈 SEE ALSO 🌈

iwconfig(8), iwlist(8), iwspy(8), iwpriv(8), wireless(7).

okay that's the whole page bestie, you're fully caught up 🎀

this was brought to you by net-tools, dated 23 June 2004 — yes she's an elder but she still slays, and this manual is the IWEVENT(8) one. mwah 💖✨