802.11k/v neighbor reports not being sent with usteer-ng

robbins · May 7, 2026, 10:06pm

To capture a pcap I ran these commands from here:

iw phy phy1 interface add phy1mon0 type monitor
ip link set phy1mon0 up
ssh -T root@openwrt_ap_1 \ "exec tcpdump -U -i phy1mon0 -w - type mgt" \
> /tmp/ap.pcap

I see .... ..1. = Neighbor Report: Enabled in Beacon frames, but when I filter for neighbor reports or response packages with wlan.tag.number == 52 || wlan.fixed.action_code == 5 I get no packets.

If I filter for neighbour requests I see 3:


No.     Time           Source                Destination           Protocol Length Info
  50340 1631.470750    Apple_75:17:03        d2:b3:70:da:ac:35     802.11   99     Action, SN=1625, FN=0, Flags=........, SSID="my_ssid"

Frame 50340: Packet, 99 bytes on wire (792 bits), 99 bytes captured (792 bits)
Radiotap Header v0, Length 56
802.11 radio information
IEEE 802.11 Action, Flags: ........
    Type/Subtype: Action (0x000d)
    Frame Control Field: 0xd000
    .000 0000 0011 1100 = Duration: 60 microseconds
    Receiver address: d2:b3:70:da:ac:35 (d2:b3:70:da:ac:35)
    Destination address: d2:b3:70:da:ac:35 (d2:b3:70:da:ac:35)
    Transmitter address: Apple_75:17:03 (c8:69:cd:75:17:03)
    Source address: Apple_75:17:03 (c8:69:cd:75:17:03)
    BSS Id: d2:b3:70:da:ac:35 (d2:b3:70:da:ac:35)
    .... .... .... 0000 = Fragment number: 0
    0110 0101 1001 .... = Sequence number: 1625
    [WLAN Flags: ........]
IEEE 802.11 Wireless Management
    Fixed parameters
        Category code: Radio Measurement (5)
        Action code: Neighbor Report Request (4)
        Dialog token: 68
    Tagged parameters (16 bytes)
        Tag: SSID parameter set: "my_ssid"
            Tag Number: SSID parameter set (0)
            Tag length: 14
            SSID: "my_ssid"

I have 2 APs with the same packages including wpad-openssl and usteer-ng (not the snapshot but release v1.0.0), whose configuration is as follows:

root@ap:~# uci show network
network.loopback=interface
network.loopback.device='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd3d:38d2:c6c8::/48'
network.device_lan=device
network.device_lan.name='br-lan'
network.device_lan.ports='eth0'
network.device_lan.type='bridge'
network.lan=interface
network.lan.device='br-lan'
network.lan.proto='dhcp'
network.device_wifinet2=device
network.device_wifinet2.mtu='1500'
network.device_wifinet2.name='wifinet2'
network.device_wifinet3=device
network.device_wifinet3.mtu='1500'
network.device_wifinet3.name='wifinet3'
network.device_wifinet0=device
network.device_wifinet0.mtu='1500'
network.device_wifinet0.name='wifinet0'
network.device_wifinet1=device
network.device_wifinet1.mtu='1500'
network.device_wifinet1.name='wifinet1'

root@ap:~# uci show wireless
wireless.radio0=wifi-device
wireless.radio0.type='mac80211'
wireless.radio0.path='platform/soc/18000000.wifi'
wireless.radio0.band='2g'
wireless.radio0.channel='1'
wireless.radio0.htmode='HE20'
wireless.radio1=wifi-device
wireless.radio1.type='mac80211'
wireless.radio1.path='platform/soc/18000000.wifi+1'
wireless.radio1.band='5g'
wireless.radio1.channel='36'
wireless.radio1.htmode='HE80'
wireless.wifi_wifinet2=wifi-iface
wireless.wifi_wifinet2.device='radio0'
wireless.wifi_wifinet2.encryption='psk2'
wireless.wifi_wifinet2.hidden='0'
wireless.wifi_wifinet2.ieee80211r='0'
wireless.wifi_wifinet2.ieee80211w='0'
wireless.wifi_wifinet2.ifname='wifinet2'
wireless.wifi_wifinet2.isolate='0'
wireless.wifi_wifinet2.key='gXShS3z&#4Da#aY3'
wireless.wifi_wifinet2.macfilter='disable'
wireless.wifi_wifinet2.mode='ap'
wireless.wifi_wifinet2.network='lan'
wireless.wifi_wifinet2.rsn_preauth='0'
wireless.wifi_wifinet2.ssid='my_ssid_printer'
wireless.wifi_wifinet2.wds='0'
wireless.wifi_wifinet2.wmm='1'
wireless.wifi_wifinet2.disabled='0'
wireless.wifi_wifinet1=wifi-iface
wireless.wifi_wifinet1.device='radio1'
wireless.wifi_wifinet1.encryption='sae-mixed+ccmp'
wireless.wifi_wifinet1.hidden='0'
wireless.wifi_wifinet1.ieee80211r='0'
wireless.wifi_wifinet1.ieee80211w='1'
wireless.wifi_wifinet1.ifname='wifinet1'
wireless.wifi_wifinet1.isolate='0'
wireless.wifi_wifinet1.key='ez2remember'
wireless.wifi_wifinet1.macfilter='disable'
wireless.wifi_wifinet1.mode='ap'
wireless.wifi_wifinet1.network='lan'
wireless.wifi_wifinet1.rsn_preauth='0'
wireless.wifi_wifinet1.ssid='my_ssid'
wireless.wifi_wifinet1.wds='0'
wireless.wifi_wifinet1.wmm='1'
wireless.wifi_wifinet1.disabled='0'
wireless.wifi_wifinet1.bss_transition='1'
wireless.wifi_wifinet1.ieee80211k='1'
wireless.wifi_wifinet3=wifi-iface
wireless.wifi_wifinet3.device='radio1'
wireless.wifi_wifinet3.disabled='0'
wireless.wifi_wifinet3.encryption='psk2'
wireless.wifi_wifinet3.hidden='0'
wireless.wifi_wifinet3.ieee80211r='0'
wireless.wifi_wifinet3.ieee80211w='0'
wireless.wifi_wifinet3.ifname='wifinet3'
wireless.wifi_wifinet3.isolate='0'
wireless.wifi_wifinet3.key='gXShS3z&#4Da#aY3'
wireless.wifi_wifinet3.macfilter='disable'
wireless.wifi_wifinet3.mode='ap'
wireless.wifi_wifinet3.network='lan'
wireless.wifi_wifinet3.rsn_preauth='0'
wireless.wifi_wifinet3.ssid='my_ssid_printer'
wireless.wifi_wifinet3.wds='0'
wireless.wifi_wifinet3.wmm='1'
wireless.wifi_wifinet0=wifi-iface
wireless.wifi_wifinet0.device='radio0'
wireless.wifi_wifinet0.disabled='0'
wireless.wifi_wifinet0.encryption='sae-mixed+ccmp'
wireless.wifi_wifinet0.hidden='0'
wireless.wifi_wifinet0.ieee80211r='0'
wireless.wifi_wifinet0.ieee80211w='1'
wireless.wifi_wifinet0.ifname='wifinet0'
wireless.wifi_wifinet0.isolate='0'
wireless.wifi_wifinet0.key='ez2remember'
wireless.wifi_wifinet0.macfilter='disable'
wireless.wifi_wifinet0.mode='ap'
wireless.wifi_wifinet0.network='lan'
wireless.wifi_wifinet0.rsn_preauth='0'
wireless.wifi_wifinet0.ssid='my_ssid'
wireless.wifi_wifinet0.wds='0'
wireless.wifi_wifinet0.wmm='1'
wireless.wifi_wifinet0.bss_transition='1'
wireless.wifi_wifinet0.ieee80211k='1'

root@ap:~# uci show usteer
usteer.usteer1=usteer
usteer.usteer1.network='lan'
usteer.usteer1.syslog='1'
usteer.usteer1.local_mode='0'
usteer.usteer1.ipv6='0'
usteer.usteer1.debug_level='2'
usteer.usteer1.roam_scan_snr='-65'
usteer.usteer1.signal_diff_threshold='8'

Am I missing any configuration?

NilsRo · May 27, 2026, 8:58pm

Hi,

neighbour reports are send by usteer via Ubus in the same way it does by the simple static neighbour reports script. So you should try to use it to test if neighbour reports are published to the stations. Second it would be interesting to trace Ubus if the command is executed to trigger a neighbour report.

Your settings looks right in general.

github.com/openwrt/packages

net/static-neighbor-reports/files/reload-neighbor-reports.lua

d1e90df7c


      
          for k, v in pairs(neighbor_reports) do
          	ubus:call('hostapd.' .. k, 'rrm_nr_set', {list=v})
          end

ubus monitor | grep rrm_nr_set

invoke: {"objid":-572239198,"method":"rrm_nr_set","data":{"list":[["xx:xx:xx3:26:60:e0","I-Gate Gastzugang","ddsvdsvdsvsdvsdv900005101070603000100"],["xx:xx:xx:26:60:78","I-Gate Gastzugang","dsvdsvdsvdsvdsv05104070603000400"]

You should see the mac, SSID and BSID of the AP that are in range.

Also be aware that a station has to request a neighbour report if I am right. It is not like a beacon send to everybody.