Re: linksys router incorrectly showing as WEP?

Hi Bryce,

On 5/12/25 10:28 AM, Bryce Johnson wrote:
> Hi All,
> We have some embedded linux devices with TI cc3301 chipset.  At one of
> our labs, the router (linksys MR6350) according to IWD will show up as
> wep security then go back to psk.
>
> Odd thing is this router doesn't even support WEP - the only security
> option it has listed in wpa2-personal or open.
>
> We have like 20 devices in the lab and it appears to be happening to
> some or all of them. I'm needing to remote desktop over to a computer
> that has a serial connection... so slightly difficult to get logs.
>
> I want to just blame the router and have them replace it, but I
> figured I'd check if there is any other issue here as well.  I have
> full IWD debug logs saved, but here is a snippet.
>
> 2025-05-12 16:15:53.428737870  Wireless daemon version 3.4
> <SNIP>
> 2025-05-12 16:15:55.791609235  src/station.c:station_print_scan_bss()
> Processing BSS 'd8:ec:5e:99:0e:6c' with SSID: Revelotest4, freq: 2427,
> rank: 492, strength: -4600, data_rate: 72.2
> 2025-05-12 16:15:55.791622150  src/station.c:station_add_seen_bss()
> Added new Network "Revelotest4" security wep
> <SNIP>
> 2025-05-12 16:22:15.714231348  src/station.c:station_print_scan_bss()
> Processing BSS 'd8:ec:5e:99:0e:6c' with SSID: Revelotest4, freq: 2427,
> rank: 492, strength: -4700, data_rate: 72.2
> 2025-05-12 16:22:15.714244273  src/station.c:station_add_seen_bss()
> Added new Network "Revelotest4" security psk
> <SNIP>
> 2025-05-12 16:22:15.717638513  src/station.c:process_network() No
> remaining BSSs for SSID: Revelotest4 -- Removing network
>
> Then killing IWD and restarting
>
> 2025-05-12 16:23:24.015924492  src/station.c:station_print_scan_bss()
> Processing BSS 'd8:ec:5e:99:0e:6c' with SSID: Revelotest4, freq: 2427,
> rank: 492, strength: -4500, data_rate: 72.2
> 2025-05-12 16:23:24.015937250  src/station.c:station_add_seen_bss()
> Added new Network "Revelotest4" security psk
>
>
> On another 2 device: (2025-05-08 date is incorrect it was before it
> got good time).  They in total had been up 30 minutes or so.
>
> device 2:
> 2025-05-08 17:00:09.699817830  src/station.c:station_add_seen_bss()
> Added new Network "Revelotest4" security wep
> 2025-05-12 16:33:47.901451708  src/station.c:station_add_seen_bss()
> Added new Network "Revelotest4" security psk
>
> device 3:
> 2025-05-08 17:00:06.777723005  src/station.c:station_add_seen_bss()
> Added new Network "Revelotest4" security wep
> 2025-05-12 16:33:49.145627332  src/station.c:station_add_seen_bss()
> Added new Network "Revelotest4" security psk
>
> That 2 devices do it at the same time - makes it seem like the router
> is doing some funky stuff.

Could you grab an iwmon pcap of this? Here you can see how the security 
level is determined, and its quite basic:

https://git.kernel.org/pub/scm/network/wireless/iwd.git/tree/src/common.c#n89

With an iwmon pcap we could see the exact bytes of the RSNE and see why 
IWD is categorizing it this way.

Thanks,
James

>
> Thank
> Bryce
>