SCANNING AND BSS LIST HANDLING(9)
๐ธ Scanning and BSS list handling ๐ธ
okay so this is the Scanning and BSS list handling(9) page from the Kernel API Manual, and bestie, it's giving "small but mighty" energy. let's get into it ๐
So the scanning process itself? honestly kind of simple, lowkey. but cfg80211 is out here offering quite a bit of helper functionality โ like it's that friend who brings snacks to the study session and also has a full color-coded spreadsheet. iconic behavior, honestly ๐ซถ
โจ starting a scan โจ
To start a scan, the scan operation gets invoked with a scan definition. and what's in that scan definition, you ask? ๐
- the channels to scan
- the SSIDs to send probe requests for (including the wildcard, if that's what you're into)
A passive scan is indicated by having no SSIDs to probe โ so like, no SSIDs, no active probing, it's just vibing and listening ๐
Additionally, a scan request may contain extra information elements that should get added to the probe request. and here's the slay part: the IEs are guaranteed to be well-formed โจ and they will not exceed the maximum length that the driver advertised in the wiphy structure. so no surprise chaos, they stay within the limits the driver set. respect. ๐
๐ฆ found a BSS? tell cfg80211 ๐ฆ
When scanning finds a BSS, cfg80211 needs to be notified of that โ because it is the one responsible for maintaining the BSS list, periodt. the driver should not maintain a list itself, no cap. and for this notification? various functions exist. pick your fighter, they're there for you ๐
๐ searching and sharing ๐
Since drivers do not maintain a BSS list, there are also a number of functions to search for a BSS and obtain information about it from the BSS structure that cfg80211 maintains. so cfg80211 holds the data, you just go ask it nicely ๐ธ
oh and โ the BSS list is also made available to userspace. everybody eats ๐
okay that's the whole vibe for this part, but there's literally more where this came from ๐
โจ SEE ALSO โจ
Kernel file ./include/net/cfg80211.h โ yes bestie, all of these live in that one header. One file. One. Iconic behaviour honestly ๐
Okay so this is the big reference list, and it is long โ so grab a snack, hydrate, and let's go through it together. I'm keeping every single one because every single one matters ๐
Introduction(9)Device registration(9)enum ieee80211_channel_flags(9)struct ieee80211_channel(9)enum ieee80211_rate_flags(9)enum ieee80211_bss_type(9)enum ieee80211_privacy(9)struct ieee80211_rate(9)struct ieee80211_he_obss_pd(9)struct cfg80211_he_bss_color(9)struct ieee80211_sta_ht_cap(9)struct ieee80211_sta_vht_cap(9)struct ieee80211_sta_he_cap(9)struct ieee80211_eht_mcs_nss_supp(9)struct ieee80211_sta_eht_cap(9)struct ieee80211_sta_uhr_cap(9)struct ieee80211_sband_iftype_data(9)enum ieee80211_edmg_bw_config(9)struct ieee80211_edmg(9)struct ieee80211_sta_s1g_cap(9)struct ieee80211_supported_band(9)_ieee80211_set_sband_iftype_data(9)ieee80211_set_sband_iftype_data(9)for_each_sband_iftype_data(9)ieee80211_get_sband_iftype_data(9)ieee80211_get_he_iftype_cap(9)ieee80211_get_he_6ghz_capa(9)ieee80211_get_eht_iftype_cap(9)ieee80211_get_uhr_iftype_cap(9)wiphy_read_of_freq_limits(9)
That's the capability-and-band era of the list, and yes there are both a _ieee80211_set_sband_iftype_data and an ieee80211_set_sband_iftype_data โ one little underscore, two whole entries, no I will not be merging them ๐
Actions and configuration(9)struct vif_params(9)struct key_params(9)struct cfg80211_chan_def(9)struct cfg80211_tid_cfg(9)struct cfg80211_tid_config(9)struct cfg80211_fils_aad(9)struct cfg80211_set_hw_timestamp(9)cfg80211_get_chandef_type(9)cfg80211_chandef_create(9)cfg80211_chandef_identical(9)cfg80211_chandef_is_edmg(9)cfg80211_chandef_is_s1g(9)cfg80211_chandef_compatible(9)nl80211_chan_width_to_mhz(9)cfg80211_chandef_get_width(9)cfg80211_chandef_valid(9)cfg80211_chandef_usable(9)cfg80211_chandef_dfs_required(9)cfg80211_chandef_dfs_usable(9)cfg80211_chandef_dfs_cac_time(9)cfg80211_chandef_primary(9)cfg80211_chandef_npca_valid(9)cfg80211_chandef_add_npca(9)cfg80211_chandef_add_dbe(9)nl80211_send_chandef(9)ieee80211_chandef_max_power(9)cfg80211_chandef_s1g_pri_width(9)cfg80211_any_usable_channels(9)enum survey_info_flags(9)struct survey_info(9)struct cfg80211_crypto_settings(9)struct cfg80211_mbssid_config(9)struct cfg80211_mbssid_elems(9)struct cfg80211_rnr_elems(9)struct cfg80211_beacon_data(9)struct cfg80211_acl_data(9)struct cfg80211_fils_discovery(9)struct cfg80211_unsol_bcast_probe_resp(9)struct cfg80211_s1g_short_beacon(9)struct cfg80211_ap_settings(9)struct cfg80211_ap_update(9)struct cfg80211_csa_settings(9)struct cfg80211_color_change_settings(9)struct iface_combination_params(9)enum station_parameters_apply_mask(9)struct sta_txpwr(9)struct link_station_parameters(9)struct link_station_del_parameters(9)struct cfg80211_ttlm_params(9)struct station_parameters(9)struct station_del_parameters(9)enum cfg80211_station_type(9)cfg80211_check_station_change(9)enum rate_info_flags(9)enum rate_info_bw(9)struct rate_info(9)enum bss_param_flags(9)struct sta_bss_parameters(9)struct cfg80211_txq_stats(9)struct cfg80211_tid_stats(9)struct link_station_info(9)struct station_info(9)struct cfg80211_sar_sub_specs(9)struct cfg80211_sar_specs(9)struct cfg80211_sar_freq_ranges(9)struct cfg80211_sar_capa(9)cfg80211_get_station(9)enum monitor_flags(9)enum mpath_info_flags(9)struct mpath_info(9)enum wiphy_bss_param_flags(9)struct bss_parameters(9)struct mesh_config(9)struct mesh_setup(9)struct ocb_setup(9)struct ieee80211_txq_params(9)struct cfg80211_ssid(9)struct cfg80211_scan_info(9)struct cfg80211_scan_6ghz_params(9)struct cfg80211_scan_request(9)struct cfg80211_match_set(9)struct cfg80211_sched_scan_plan(9)struct cfg80211_bss_select_adjust(9)struct cfg80211_sched_scan_request(9)enum cfg80211_signal_type(9)struct cfg80211_inform_bss(9)struct cfg80211_bss_ies(9)struct cfg80211_bss(9)ieee80211_bss_get_elem(9)ieee80211_bss_get_ie(9)struct cfg80211_auth_request(9)struct cfg80211_assoc_link(9)struct cfg80211_ml_reconf_req(9)enum cfg80211_assoc_req_flags(9)struct cfg80211_assoc_request(9)struct cfg80211_deauth_request(9)struct cfg80211_disassoc_request(9)struct cfg80211_ibss_params(9)struct cfg80211_bss_selection(9)struct cfg80211_connect_params(9)enum cfg80211_connect_params_changed(9)enum wiphy_params_flags(9)struct cfg80211_pmksa(9)struct cfg80211_pkt_pattern(9)struct cfg80211_wowlan_tcp(9)struct cfg80211_wowlan(9)struct cfg80211_coalesce_rules(9)struct cfg80211_coalesce(9)struct cfg80211_wowlan_nd_match(9)struct cfg80211_wowlan_nd_info(9)struct cfg80211_wowlan_wakeup(9)struct cfg80211_gtk_rekey_data(9)struct cfg80211_update_ft_ies_params(9)struct cfg80211_mgmt_tx_params(9)struct cfg80211_dscp_exception(9)struct cfg80211_dscp_range(9)struct cfg80211_qos_map(9)
Alphabetical-ish would've been nice but no, we're vibing through the structs in file order, and honestly? Respect ๐ซถ
Neighbor Awareness Networking (NAN)(9)struct cfg80211_nan_band_config(9)struct cfg80211_nan_conf(9)struct cfg80211_nan_channel(9)struct cfg80211_nan_local_sched(9)struct cfg80211_nan_peer_map(9)struct cfg80211_nan_peer_sched(9)enum cfg80211_nan_conf_changes(9)struct cfg80211_nan_func_filter(9)struct cfg80211_nan_func(9)struct cfg80211_pmk_conf(9)struct cfg80211_external_auth_params(9)struct cfg80211_ftm_responder_stats(9)struct cfg80211_pmsr_ftm_result(9)struct cfg80211_pmsr_result(9)struct cfg80211_pmsr_ftm_request_peer(9)struct cfg80211_pmsr_request_peer(9)struct cfg80211_pmsr_request(9)struct cfg80211_update_owe_info(9)struct mgmt_frame_regs(9)struct cfg80211_ops(9)enum wiphy_flags(9)struct ieee80211_iface_limit(9)struct ieee80211_iface_combination(9)enum wiphy_wowlan_support_flags(9)struct wiphy_wowlan_support(9)struct wiphy_coalesce_support(9)enum wiphy_vendor_command_flags(9)enum wiphy_opmode_flag(9)struct sta_opmode_info(9)struct wiphy_vendor_command(9)struct wiphy_iftype_ext_capab(9)cfg80211_get_iftype_ext_capa(9)struct cfg80211_pmsr_capabilities(9)struct wiphy_iftype_akm_suites(9)struct wiphy_radio_cfg(9)struct wiphy_radio_freq_range(9)struct wiphy_radio(9)enum wiphy_nan_flags(9)struct wiphy_nan_capa(9)struct wiphy(9)wiphy_priv(9)priv_to_wiphy(9)set_wiphy_dev(9)wiphy_dev(9)wiphy_name(9)wiphy_new_nm(9)wiphy_new(9)wiphy_register(9)rcu_dereference_wiphy(9)wiphy_dereference(9)get_wiphy_regdom(9)wiphy_unregister(9)wiphy_free(9)wiphy_lock(9)wiphy_unlock(9)wiphy_work_queue(9)wiphy_work_cancel(9)wiphy_work_flush(9)wiphy_delayed_work_queue(9)wiphy_delayed_work_cancel(9)wiphy_delayed_work_flush(9)wiphy_delayed_work_pending(9)wiphy_hrtimer_work_queue(9)wiphy_hrtimer_work_cancel(9)wiphy_hrtimer_work_flush(9)wiphy_hrtimer_work_pending(9)enum ieee80211_ap_reg_power(9)struct wireless_dev(9)wdev_priv(9)wdev_chandef(9)
The whole wiphy_work_* / wiphy_delayed_work_* / wiphy_hrtimer_work_* family is here in full โ queue, cancel, flush, and (for the delayed + hrtimer ones) pending. Four flavours each, no cap ๐
Utility functions(9)ieee80211_channel_equal(9)ieee80211_channel_to_khz(9)ieee80211_channel_to_freq_khz(9)ieee80211_channel_to_frequency(9)ieee80211_freq_khz_to_channel(9)ieee80211_frequency_to_channel(9)ieee80211_get_channel_khz(9)ieee80211_get_channel(9)cfg80211_channel_is_psc(9)ieee80211_radio_freq_range_valid(9)cfg80211_radio_chandef_valid(9)cfg80211_wdev_channel_allowed(9)ieee80211_get_response_rate(9)ieee80211_mandatory_rates(9)struct ieee80211_radiotap_iterator(9)ieee80211_get_hdrlen_from_skb(9)ieee80211_hdrlen(9)ieee80211_get_mesh_hdrlen(9)
Note that ieee80211_channel_to_khz, ieee80211_channel_to_freq_khz and ieee80211_channel_to_frequency are all separate entries, and so are ieee80211_freq_khz_to_channel and ieee80211_frequency_to_channel โ yes the khz and non-khz versions both exist, keep them straight bestie ๐ฆ
Data path helpers(9)ieee80211_data_to_8023_exthdr(9)ieee80211_data_to_8023(9)ieee80211_is_valid_amsdu(9)ieee80211_amsdu_to_8023s(9)ieee80211_get_8023_tunnel_proto(9)ieee80211_strip_8023_mesh_hdr(9)cfg80211_classify8021d(9)cfg80211_find_elem_match(9)cfg80211_find_ie_match(9)cfg80211_find_elem(9)cfg80211_find_ie(9)cfg80211_find_ext_elem(9)cfg80211_find_ext_ie(9)cfg80211_find_vendor_elem(9)cfg80211_find_vendor_ie(9)enum cfg80211_rnr_iter_ret(9)cfg80211_iter_rnr(9)cfg80211_defragment_element(9)cfg80211_send_layer2_update(9)
The finder family is fully intact: elem, ie, elem_match, ie_match, ext_elem, ext_ie, vendor_elem, vendor_ie. Eight of them. All distinct. Do not @ me ๐ญ
Regulatory enforcement infrastructure(9)regulatory_hint(9)regulatory_set_wiphy_regd(9)regulatory_set_wiphy_regd_sync(9)wiphy_apply_custom_regulatory(9)freq_reg_info(9)reg_initiator_name(9)regulatory_pre_cac_allowed(9)Internal regulatory db functions(9)reg_query_regdb_wmm(9)cfg80211_scan_done(9)cfg80211_sched_scan_results(9)cfg80211_sched_scan_stopped(9)cfg80211_sched_scan_stopped_locked(9)cfg80211_inform_bss_frame_data(9)cfg80211_gen_new_bssid(9)cfg80211_is_element_inherited(9)cfg80211_merge_profile(9)enum cfg80211_bss_frame_type(9)cfg80211_get_ies_channel_number(9)cfg80211_ssid_eq(9)cfg80211_inform_bss_data(9)__cfg80211_get_bss(9)cfg80211_get_bss(9)cfg80211_ref_bss(9)cfg80211_put_bss(9)cfg80211_unlink_bss(9)cfg80211_bss_iter(9)cfg80211_rx_mlme_mgmt(9)cfg80211_auth_timeout(9)struct cfg80211_rx_assoc_resp_data(9)cfg80211_rx_assoc_resp(9)struct cfg80211_assoc_failure(9)cfg80211_assoc_failure(9)cfg80211_tx_mlme_mgmt(9)cfg80211_rx_unprot_mlme_mgmt(9)cfg80211_michael_mic_failure(9)cfg80211_ibss_joined(9)cfg80211_notify_new_peer_candidate(9)
Heads up: __cfg80211_get_bss(9) and cfg80211_get_bss(9) are both on here โ the double-underscore one is its own entry, so don't go thinking they're the same thing โจ
RFkill integration(9)wiphy_rfkill_set_hw_state_reason(9)wiphy_rfkill_start_polling(9)wiphy_rfkill_stop_polling(9)Vendor commands(9)cfg80211_vendor_cmd_alloc_reply_skb(9)cfg80211_vendor_cmd_reply(9)cfg80211_vendor_cmd_get_sender(9)cfg80211_vendor_event_alloc(9)cfg80211_vendor_event_alloc_ucast(9)cfg80211_vendor_event(9)Test mode(9)cfg80211_testmode_alloc_reply_skb(9)cfg80211_testmode_reply(9)cfg80211_testmode_alloc_event_skb(9)cfg80211_testmode_event(9)struct cfg80211_fils_resp_params(9)struct cfg80211_connect_resp_params(9)cfg80211_connect_done(9)cfg80211_connect_bss(9)cfg80211_connect_result(9)cfg80211_connect_timeout(9)struct cfg80211_roam_info(9)cfg80211_roamed(9)cfg80211_port_authorized(9)cfg80211_disconnected(9)cfg80211_ready_on_channel(9)cfg80211_remain_on_channel_expired(9)cfg80211_tx_mgmt_expired(9)cfg80211_sinfo_alloc_tid_stats(9)cfg80211_link_sinfo_alloc_tid_stats(9)cfg80211_sinfo_release_content(9)cfg80211_new_sta(9)cfg80211_del_sta_sinfo(9)cfg80211_del_sta(9)cfg80211_conn_failed(9)struct cfg80211_rx_info(9)cfg80211_rx_mgmt_ext(9)cfg80211_rx_mgmt_khz(9)cfg80211_rx_mgmt(9)struct cfg80211_tx_status(9)cfg80211_mgmt_tx_status_ext(9)cfg80211_mgmt_tx_status(9)cfg80211_control_port_tx_status(9)cfg80211_rx_control_port(9)cfg80211_cqm_rssi_notify(9)cfg80211_cqm_pktloss_notify(9)cfg80211_cqm_txe_notify(9)cfg80211_cqm_beacon_loss_notify(9)__cfg80211_radar_event(9)cfg80211_sta_opmode_change_notify(9)cfg80211_cac_event(9)cfg80211_background_cac_abort(9)cfg80211_gtk_rekey_notify(9)cfg80211_pmksa_candidate_notify(9)cfg80211_rx_spurious_frame(9)cfg80211_rx_unexpected_4addr_frame(9)cfg80211_probe_status(9)cfg80211_report_obss_beacon_khz(9)cfg80211_report_obss_beacon(9)struct cfg80211_beaconing_check_config(9)
And that's the whole reference list, bestie โ every last (9) accounted for, nothing dropped, nothing renamed ๐ Three-hundred-plus entries and we got through them all. If you were looking for something and it's not here, then it's not in the SEE ALSO, periodt ๐ซถ
okay so the SEE ALSO fam is huge โ like, this is the extended-extended family and they all pulled up to the group chat at once ๐. Every single one, no skips, no cap, in order:
cfg80211_reg_check_beaconing(9)โ the beaconing check, she's here for it ๐cfg80211_reg_can_beacon(9)โ the "can we beacon" queen ๐cfg80211_reg_can_beacon_relax(9)โ same question, โจchill editionโจcfg80211_ch_switch_notify(9)โ channel switch news, iconiccfg80211_ch_switch_started_notify(9)โ and the "ok it actually started" version ๐ฃieee80211_operating_class_to_band(9)โ operating class โ band, converting her little heart outieee80211_operating_class_to_chandef(9)โ same energy, different outputieee80211_chandef_to_operating_class(9)โ the reverse trip ๐ieee80211_chandef_to_khz(9)โ hertz but make it kilocfg80211_tdls_oper_request(9)โ TDLS request business, respect hercfg80211_calculate_bitrate(9)โ the math girlie ๐งฎcfg80211_unregister_wdev(9)โ unregister eracfg80211_register_netdevice(9)โ register eracfg80211_unregister_netdevice(9)โ unregister era, part two ๐ญstruct cfg80211_ft_event_params(9)โ a struct, not a function, do not come for her ๐ฆcfg80211_ft_event(9)โ also on the list, periodtcfg80211_get_p2p_attr(9)โ getting the p2p attr, she's got itieee80211_ie_split_ric(9)โ splitting, ric editionieee80211_ie_split(9)โ splitting, classic editionieee80211_fragment_element(9)โ fragmenting that element bestiecfg80211_report_wowlan_wakeup(9)โ the wowlan wakeup report, very main charactercfg80211_crit_proto_stopped(9)โ crit proto stopped, note it ๐ieee80211_get_num_supported_channels(9)โ how many channels? she'll count ๐ฆcfg80211_check_combinations(9)โ checking the comboscfg80211_iter_combinations(9)โ iterating the same combos, lowkey obsessedcfg80211_get_radio_idx_by_chan(9)โ radio index, by chancfg80211_stop_link(9)โ stopping the link, no notescfg80211_stop_iface(9)โ stopping the iface, no notescfg80211_shutdown_all_interfaces(9)โ all of them, dramatic ๐ญ๐ฅwiphy_ext_feature_set(9)โ setting that ext featurewiphy_ext_feature_isset(9)โ and her sibling, the "is it set tho" onecfg80211_free_nan_func(9)โ freeing the nan func, we love a cleanupstruct cfg80211_nan_match_params(9)โ another struct bestie, respect the vibes ๐ฆcfg80211_nan_match(9)โ nan match, she matched ๐ซถcfg80211_nan_func_terminated(9)โ and now she's terminated, bye ๐cfg80211_nan_sched_update_done(9)โ sched update done, slaycfg80211_external_auth_request(9)โ external auth, requestingcfg80211_pmsr_report(9)โ pmsr report incomingcfg80211_pmsr_complete(9)โ pmsr complete, and that's thatcfg80211_iftype_allowed(9)โ is the iftype allowed? vibe check ๐cfg80211_assoc_comeback(9)โ assoc comeback, she's texting you back fr frcfg80211_update_owe_info_event(9)โ updating the owe info eventcfg80211_bss_flush(9)โ flush the bss, clean girl aesthetic โจcfg80211_bss_color_notify(9)โ bss color notifycfg80211_obss_color_collision_notify(9)โ obss collision notify, chaos but make it cutecfg80211_color_change_started_notify(9)โ color change started, we're so backcfg80211_color_change_aborted_notify(9)โ color change aborted, we're so not back ๐ญcfg80211_color_change_notify(9)โ color change notify, the neutral onecfg80211_6ghz_power_type(9)โ 6ghz power type, six g's of itcfg80211_links_removed(9)โ links removed, gone girl ๐struct cfg80211_mlo_reconf_done_data(9)โ struct alert again, she's data not a function ๐ฆcfg80211_mlo_reconf_add_done(9)โ mlo reconf add donecfg80211_schedule_channels_check(9)โ scheduling the channels check, organized queencfg80211_epcs_changed(9)โ epcs changed, notedcfg80211_next_nan_dw_notif(9)โ next nan dw notifcfg80211_nan_cluster_joined(9)โ nan cluster joined, welcome to the group chat ๐ซถcfg80211_nan_ulw_update(9)โ nan ulw updatecfg80211_nan_channel_evac(9)โ nan channel evac, everybody out ๐โโ๏ธwiphy_locked_debugfs_read(9)โ locked debugfs, read editionwiphy_locked_debugfs_write(9)โ locked debugfs, write editioncfg80211_s1g_get_start_freq_khz(9)โ s1g start freq, in khz, exactly as namedcfg80211_s1g_get_end_freq_khz(9)โ s1g end freq, also khzcfg80211_s1g_get_primary_sibling(9)โ s1g primary sibling, family drama ๐งcfg80211_incumbent_signal_notify(9)โ incumbent signal notify, last but never least ๐
and that's the whole page, bestie โ you made it to the end of all three parts ๐ like genuinely, go hydrate. this one lives over in ./include/net, dated October 2026, and it's part of the Kernel API Manual as Scanning and...ist handling(9). bye ily, go read the actual pages now ๐โจ
๐ฆ where this page comes from
- nixpkgs unstable: linux-manual 7.3.1
- ๐ girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms