WPA_CLI(8)

✨ NAME ✨

wpa_cli — the WPA command line client 🫶 (this is page 8 of the manual, so like, sysadmin territory, bestie)

---

🌸 SYNOPSIS 🌸

wpa_cli [ -p path to ctrl sockets ] [ -g path to global ctrl_interface
socket ] [ -i ifname ] [ -hvB ] [ -a action file ] [ -P pid file ] [ -G
ping interval ] [ command ... ]

---

💖 OVERVIEW 💖

So wpa_cli is a text-based frontend program that talks to wpa_supplicant. That's the whole vibe. You use it to query current status, change configuration, trigger events, and request interactive user input. Very main character of it, honestly. 👑

Like, it can show you the current authentication status, the selected security mode, dot11 and dot1x MIBs, all of it. And that's not even the half of it — it can also configure some variables, like EAPOL state machine parameters, and trigger events like reassociation and IEEE 802.1X logoff/logon. Iconic.

wpa_cli also gives you a whole user interface for requesting authentication information, like username and password, when those aren't chilling in the configuration file. Which is lowkey huge, because it means you can implement stuff like one-time-passwords or generic token card authentication, where the auth is based on a challenge-response that uses an external device to generate the response. Fr fr, that's a real use case. 🎀

The control interface of wpa_supplicant can be configured to allow non-root user access — that's the ctrl_interface GROUP= parameter in the configuration file, iykyk — which means yes, you can absolutely run wpa_cli with a normal user account. No sudo required, bestie. ✨

Now, wpa_cli supports two modes: interactive and command line. Both modes share the exact same command set, the only real difference is that interactive mode gives you access to unsolicited messages (event messages, username/password requests). That's it. That's the tea. 🍓

• Interactive mode starts when you run wpa_cli without passing a command as a command line parameter. You then type commands right there at the wpa_cli prompt.
• Command line mode is the same commands, except you enter them as command line arguments to wpa_cli.

---

🔐 INTERACTIVE AUTHENTICATION PARAMETERS REQUEST 🔐

Okay so here's the situation. When wpa_supplicant needs authentication parameters — username, password, that kind of thing — and they are NOT present in the configuration file, it sends a request message out to all attached frontend programs. So like, wpa_cli in interactive mode is one of those. 👀

wpa_cli shows you these requests with a CTRL-REQ-<type>-<id>:<text> prefix. Let's break that down because the details matter:

• <type> is one of IDENTITY, PASSWORD, or OTP (one-time-password).
• <id> is a unique identifier for the current network.
• <text> is a description of the request. And in the case of an OTP request, it includes the challenge from the authentication server. Spicy. 🌶️

You reply to these requests with the identity, password, and otp commands. You need to copy <id> from the matching request — don't make it up, bestie, it has to match.

password and otp can be used regardless of whether the request was for PASSWORD or OTP. The main difference between the two commands is this:

• values given with password are remembered for as long as wpa_supplicant is running 🧠
• values given with otp are used only once and then forgotten — i.e., wpa_supplicant will ask the frontend for a brand new value for every single use 💀

And that is what lets you implement one-time-password lists and generic token card-based authentication. Slay.

Example request for password and a matching reply:

CTRL-REQ-PASSWORD-1:Password needed for SSID foobar
> password 1 mysecretpassword

Example request for generic token card challenge-response:

CTRL-REQ-OTP-2:Challenge 1235663 needed for SSID foobar
> otp 2 9876

---

🛠️ COMMAND ARGUMENTS 🛠️

• -p path — change the path where control sockets should be found.
• -g control socket path — connect to the global control socket at the indicated path rather than an interface-specific control socket.
• -i ifname — specify the interface that is being configured. By default, it picks the first interface found with a control socket in the socket path. (Default behaviour, no cap. 🙈)
• -h — help. Shows you a usage message.
• -v — show version information.
• -B — run as a daemon in the background.
• -a file — run in daemon mode, executing the action file based on events from wpa_supplicant. The specified file gets executed with the first argument set to the interface name and the second set to "CONNECTED" or "DISCONNECTED" depending on the event. This is how you run networking tools that are required to configure the interface. 💅

Also — and this part is important — three environmental variables are available to that file: WPA_CTRL_DIR, WPA_ID, and WPA_ID_STR.

• WPA_CTRL_DIR contains the absolute path to the ctrl_interface socket.
• WPA_ID contains the unique network_id identifier assigned to the active network.
• WPA_ID_STR contains the content of the id_str option.

• -P file — set the location of the PID file.
• -G ping interval — set the interval (in seconds) at which wpa_cli pings the supplicant. 🏓
• command — run a command. The available commands are listed in the next section. 👇

---

👑 COMMANDS 👑

The following commands are available:

• status — get current WPA/EAPOL/EAP status
• mib — get MIB variables (dot1x, dot11)
• help — show this usage help
• interface [ifname] — show interfaces / select interface
• level <debug level> — change debug level
• license — show full wpa_cli license
• logoff — IEEE 802.1X EAPOL state machine logoff
• logon — IEEE 802.1X EAPOL state machine logon
• set — set variables (and it shows you the list of variables when you run it without arguments, cute)
• pmksa — show PMKSA cache
• reassociate — force reassociation
• reconfigure — force wpa_supplicant to re-read its configuration file
• preauthenticate <BSSID> — force preauthentication
• identity <network id> <identity> — configure identity for an SSID
• password <network id> <password> — configure password for an SSID
• pin <network id> <pin> — configure pin for an SSID
• otp <network id> <password> — configure one-time-password for an SSID
• bssid <network id> <BSSID> — set preferred BSSID for an SSID
• list_networks — list configured networks
• terminate — terminate wpa_supplicant
• quit — exit wpa_cli

---

🔗 SEE ALSO 🔗

• wpa_supplicant(8)

---

📜 LEGAL 📜

wpa_supplicant is copyright (c) 2003-2022, Jouni Malinen <j@w1.fi> and contributors. All Rights Reserved.

This program is licensed under the BSD license (the one with advertisement clause removed). 📄✨

---

And that's the whole page, bestie — this one landed on 07 August 2019 as part of the wpa_cli(8) manual. Go forth and configure your interfaces. 💖🦋