Problem with WEP in one direction!?

Hi

I have a USB Atmel wifi inside a Lex Light system.  I've had nothing but
lock-ups using the sourceforge driver, so I'm delighted that the berlios one
loada up just fine, finds the access-point and goes into "CONNECTED" state.
Only problem is, I can't get packets to go anywhere in a useful way.  It's
as if the atmel can decrypt packets OK but can't encrypt them, as they're
not being decoded by the destination node.

I'm trying this on a Redhat 9 box; I've tried version 0.11 and the latest
snapshot (last change Jan 20 2004 I think).  Both have the same problem.
Kernel is 2.4.24.  I've also tried an older firmware but that didn't make
any difference.

After trawling the archives, I've found several postings that had similar
problems.  While useful to compare, it seems my problem is in fact
different.  Curiously though, their logs show an AUTHENTICATION stage that
my device doesn't ever go into.  Not sure if this is a problem.

If I turn off WEP I can ping a laptop running Win2k.  I've confirmed that
the keys match, but no workies when WEP is turned back on.

I have another redhat box that the win2k laptop can talk to using WEP.  It's
in managed mode, and runs a wavelan2_cs module for an enterasys PCMCIA card.
This is what the atmel driver is CONNECTing to as an AP.  If I ping from
this managed node to the atmel device, tcpdump running on the enterasys
shows arp packets go out, but garbage coming back; tcpdump on the atmel
shows arp in and arp-reply out.  It's as if the atmel can decrypt incoming
packets with the key, but can't encrypt the packets it sends out.

If I ping from the enterasys node, the atmel node puts an arp entry into its
cache.  If I ping only the other way, no arp entry in cache.

I've tried turning off encryption on both linux boxes, but arp replies don't
seem to get back into the atmel node.

Settings for atmel node:

# iwconfig wlan0
wlan0     IEEE 802.11-DS  ESSID:"myessid"  Nickname:"atmel"
          Mode:Ad-Hoc  Channel:10  Cell: 02:62:77:01:2A:92
          Bit Rate:11Mb/s
          RTS thr=1536 B   Fragment thr=1536 B
          Encryption key:XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XX   Encryption
mode:open
          Power Management:off
          Link Quality:0  Signal level:50  Noise level:0
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

# ifconfig wlan0
wlan0     Link encap:Ethernet  HWaddr 00:06:F4:02:87:B7
          inet addr:192.168.16.99  Bcast:192.168.16.255  Mask:255.255.255.0
          UP BROADCAST  MTU:1500  Metric:1
          RX packets:72 errors:0 dropped:0 overruns:0 frame:0
          TX packets:147 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:4608 (4.5 Kb)  TX bytes:8896 (8.6 Kb)

Settings for enterasys node:

eth2      Wireless  ESSID:"myessid"  Nickname:"enterasys"
          Mode:Managed  Frequency:2.457GHz  Access Point: 02:62:77:01:2A:92
          Sensitivity:1/0
          RTS thr:off
          Encryption key:XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XX
          Link Quality:0/0  Signal level:-102 dBm  Noise level:-102 dBm
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:2   Missed beacon:0

eth2      Link encap:Ethernet  HWaddr 00:E0:63:83:2C:ED
          inet addr:192.168.16.1  Bcast:192.168.16.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:7800 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8120 errors:7 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:757808 (740.0 Kb)  TX bytes:6179592 (5.8 Mb)
          Interrupt:9 Base address:0x100

Start-up log entries as follows - modules.conf contains 'options at76c503
debug=0x104003'.

at76c503.c: Generic Atmel at76c503/at76c505 routines v0.11
at76c503-rfmd.c: Atmel at76c503 (RFMD) Wireless LAN Driver v0.11
at76c503.c: Sending remap command...
usb.c: registered new driver at76c503-rfmd
at76c503.c: Downloading external ...
at76c503.c: ext fw, size left = 12736, bsize = 1024, i =  0
at76c503.c: ext fw, size left = 11712, bsize = 1024, i =  1
at76c503.c: ext fw, size left = 10688, bsize = 1024, i =  2
at76c503.c: ext fw, size left =  9664, bsize = 1024, i =  3
at76c503.c: ext fw, size left =  8640, bsize = 1024, i =  4
at76c503.c: ext fw, size left =  7616, bsize = 1024, i =  5
at76c503.c: ext fw, size left =  6592, bsize = 1024, i =  6
at76c503.c: ext fw, size left =  5568, bsize = 1024, i =  7
at76c503.c: ext fw, size left =  4544, bsize = 1024, i =  8
at76c503.c: ext fw, size left =  3520, bsize = 1024, i =  9
at76c503.c: ext fw, size left =  2496, bsize = 1024, i = 10
at76c503.c: ext fw, size left =  1472, bsize = 1024, i = 11
at76c503.c: ext fw, size left =   448, bsize =  448, i = 12
at76c503.c: $Id: at76c503.c,v 1.35 2003/07/30 06:31:51 jal2 Exp $ compiled
Feb 10 2004 12:39:11
at76c503.c: firmware version 0.90.2 #140 (fcs_len 4)
at76c503.c: device's MAC 00:06:f4:02:87:b7, regulatory domain ETSI (Europe -
(Spain+France) (id 48)
at76c503.c: registered wlan0
at76c503.c: wlan0 param: ssid rebel-it (726562656C2D6974) mode adhoc ch 10
wep enabled key 0 keylen 13
at76c503.c: wlan0 param: preamble long rts 1536 frag 1536 txrate auto excl 0
at76c503.c: wlan0 param: pm_mode 1 pm_period 0 auth_mode open scan_times 10
120scan_mode active
at76c503.c: wlan0: state 0 -> 1 (SCANNING)
at76c503.c: wlan0 BSS table (curr=00000000, new=00000000):
at76c503.c: 0xc13654c0: bssid 02:00:25:68:0a:64 channel 10 ssid rebel-it
(726562656C2D6974) capa x0012 rates 02 04 0B 16 rssi 1 link 0 noise 0
at76c503.c: wlan0 BSS table (curr=00000000, new=00000000):
at76c503.c: 0xc13654c0: bssid 02:00:25:68:0a:64 channel 10 ssid rebel-it
(726562656C2D6974) capa x0012 rates 02 04 0B 16 rssi 18 link 0 noise 0
at76c503.c: wlan0: state 1 -> 6 (JOINING)
at76c503.c: wlan0 find_matching_bss: returned c13654c0
at76c503.c: wlan0 join addr 02:00:25:68:0a:64 ssid rebel-it type 1 ch 10
timeout 2000
at76c503.c: wlan0: state 6 -> 7 (CONNECTED)
at76c503.c: wlan0: rx newbss
at76c503.c: ibss_change = 0x 1
at76c503.c: using BSSID 02:62:77:01:2a:92


tcpdump on enterasys node shows:

13:26:02.163060 arp who-has 192.168.16.99 tell 192.168.16.1
13:26:02.165096 0:6:f4:2:87:b7 0:e0:63:83:3e:10 4625 68:
                         956a c5b5 d1b3 5a4a 2d2b 7948 d849 2190
                         c5b4 99e7 9349 06e1 bf17 3fb9 e394 2863
                         fd75 b7d8 69a8 c66d 198c 73ae e16a cd82
                         ab8c 3f00 0a04
13:26:03.163052 arp who-has 192.168.16.99 tell 192.168.16.1
13:26:03.165941 aa:7a:c7:fa:f6:fe b7:d4:e9:fc:f5:e0 62d0 68:
                         4494 04bb 1411 bec7 a24c f270 734f 0083
                         c20b d2ed 8106 6915 899e 755f 3fb0 a85c
                         848c 2d2f 7e46 662e fa1a fa95 ea75 27c4
                         2967 3f00 1400

This is very frustrating - so close!  I hope someone can help me get this
last little bit working.

Cheers
Jeremy