How does rrm work?

Any idea how to interpret the data returned by the beacon reports? I have no idea how to pull some sort of RSSI out of there and force a roam via bss-tm to the best AP.

I got pretty much everything working, except for that.

I am using hostapd_cli for what its worth, but when i specify multiple neighbor= parameters the client will always just roam to the first one I provide. Even if its clearly a weaker signal.

I have done some Pull Request, that parses beacon reports:

Forgive me for being a bit of a newbie, but once I patch the build dir with this - how can it be integrated in to this script?

What do you mean by patch the build dir with this?

I patched openwrt/hostapd with your PR.

I'd like to just know if it does the job automatically once I set beacon_requests=1 or do I need to do something else like the umdns script in the previous posts in this thread.

Tested your patch and tested the command:

ubus call hostapd.wlan0 rrm_beacon_req '{"addr":"00:xx:xx:xx:xx:xx", "op_class":0, "channel":1,"duration":1,"mode":2,"bssid":"ff:ff:ff:ff:ff:ff", "ssid":""}

on QCA988X-ath10k-ct-htt, Archer A7v5, the following command works and logread gives me a hex string:

ubus call hostapd.wlan0 rrm_beacon_req '{"addr":"AA:BB:CC:XX:YY:ZZ", "op_class":1, "channel":48,"duration":100,"mode":0,"bssid":"ZZ:YY:XX:AA:BB:CC", "ssid":

It returns hex values like: 012a754b36

For ath10k-ct-htt, it was key that I set duration to 100 and mode to 0 for the report to be generated.

My iPhone 11 Pro creates more detailed beacon reports and supports active/passive beacons. I don't want to post the hex output since using a Hex2ASCII converter shows my SSID and RegDomain settings.

I would like to know what happens when you issue a command "ubus call hostapd.wlan0 rrm_beacon_req" on the AP with the patch.

Does AP send an action frame to the client and client responds with neighbor AP list?

  1. Yes, the AP sends an action rame to the client to initiate the beacon report request. Currently you have to manually specify a client that you'll receive reports from.

  2. It responds with a hex string. Depending on the distance from the router, the hex string may or may not get cut off. When the SNR is low, the client produces a long hex string, which when converted to ASCII contains details on SSID and regdomain. However the rest of the message is garbled.

1 Like

If you look at my commit message:

But you have to subscribe to notifications! :wink: Then the hex string will be automatically formated into a json object that gives you all information you need.

I did that here:

And then you will receive blobmessages.

1 Like

An easyer way is to delete that if:

And do

 ubus monitor

or more specific

ubus monitor [ubus hostapd inferface]

Then u don't have to write a whole daemon that is subscribing to this notifications.


Okay the link does not work.

Delete in my patch:

if (!hapd->ubus.obj.has_subscribers)

@ParanoidZoid, @kaputorwon: Please indicate on Github, that you tested the PR.

1 Like

@ParanoidZoid, @kaputorwon: Please indicate on Github, that you tested the PR.
I have yet to test your patch since my build is not ready yet. It's very interesting. I appreciate your great work!

I would like to know how AP collects neighboring AP prior to sending neighboring report down to client. Where does AP keep the AP lists?

I tried several things. But currently, I had no time to go on.

You can try to send a neighbor-report-element with a bss-transition like I tried here:

So you guide the client to a specific AP. So bss transition is based on neighbor reports.

1 Like

My intention is to exercise 11k protocol by itself. We have two RM capabilities in the beacon to enable through ubus call hostapd.wlan0 bss_mgmt_enable '{"neighbor_report":True, "beacon_report":True}'. I just wanted to find out how an AP collects neighbor AP list. My query is if AP collects neighbor ap list by scanning or by sending action frame to client and client responds with it's scan results. I am not attempting to do client guided roaming. Thanks.

There are different use cases:

  1. AP exchange NB reports through backbone and clients request roaming possibilites through beacon
  2. AP requests NB report from client to get hearing map information
  3. ...

I'm not sure, what else. :wink:

1 Like

Thanks for the response. I am pursuing pt.#2 which you've done it with your patch, I guess.

What are your plans in terms of coding? I sent a mail via openwrt mailing list and hopefully it is getting merged. :slight_smile:

1 Like

I have no plan to do any coding at the moment as regards to rrm feature. I'm just curious to see whether there is any of 802.11k feature/protocol in place in the OpenWrt. Anyway I appreciate your contribution!

Could we maybe finally package that script?

1 Like

In /etc/init.d/neighbor_report:

#!/bin/sh /etc/rc.common



radios=$(ubus list | grep hostapd.wlan)

start_service() {
	local rrm_own

	for value in ${radios}
		rrm_own=${rrm_own}",$(ubus call ${value} rrm_nr_get_own | jsonfilter -e '$.value')"


	procd_set_param command /bin/sh "/usr/bin/rrm"
	procd_add_mdns "rrm" "udp" "" "${rrm_own:1}"

	procd_add_reload_trigger wireless

In /usr/bin/rrm


radios=$(ubus list | grep hostapd.wlan)

_discover_neighbors() {
	local rrm_neighbors

	ubus call umdns update
	sleep 2

	rrm_neighbors=$(ubus call umdns browse | jsonfilter -e '@["_rrm._udp"][*].txt')

	for value in ${rrm_neighbors}

_append_own() {
	for value in ${radios}
		rrm_nr_lists=${rrm_nr_lists}",$(ubus call ${value} rrm_nr_get_own | jsonfilter -e '$.value')"

while true



	for value in ${radios}
		ubus call ${value} bss_mgmt_enable '{"neighbor_report": true}'
		eval "ubus call ${value} rrm_nr_set '{ \"list\": [ ${rrm_nr_lists:1} ] }'"

	sleep 60


exit 0

These scripts would probably fare better if they were (1) integrated as easily as 802.11r is now enabled via and (2) lives as a hotplud.d script watching the wlan0/wlan1 interface(s). Right now, I don't really have the time to figure this out myself and this script from @sotux and @muddyfeet does what it needs to do albeit a few caveats if something is shut down/rebooted.

Additionally, umdns is a requirement.


I'm now able to set the nr reports for hostapd with dawn:


I'm playing with the ubus commands to see how my devices respond to manual instructions. I'm finding that one of the APs is missing the wnm_disassoc_imminent method from ubus -v list hostapd.wlan0-1.

/tmp/run/hostapd-phy0.conf look very similar on each device, and both have disassoc_low_ack=1

Can anyone give me a clue if that is a hardware, driver, configuration or perhaps package snag?

In case it helps, the one without the method is running ath79/tiny DTS style, the one with it is ar71xx/nand.

EDIT: Looks like this may depend on hostapd and / or other things being compiled with CONFIG_WNM_AP defined...