iwlist scan shows non-existent hotspot

[GNUser]

I discovered something strange. If I connect my laptop to a hotspot, for example  AndroidAP  being hosted on my phone, then the hotspot goes away (because I completely powered off my phone for example), the next time I scan for networks using this command on the laptop...

Code: [Select]

$ sudo iwlist wlan0 scanning
...the now-nonexistent  AndroidAP  hotspot still shows up in the scan results. I have to scan a second time in order for the nonexistent hotspot to disappear from the scan results.

Any idea why the hotspot scan is finding this non-existent hotspot?

[GNUser]

Here's relevant part of scan results when  AndroidAP  is up:

Code: [Select]

         Cell 21 - Address: [redacted]
                    Channel:1
                    Frequency:2.412 GHz (Channel 1)
                    Quality=70/70  Signal level=-37 dBm 
                    Encryption key:on
                    ESSID:"AndroidAP-bd"
                    Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 18 Mb/s
                              24 Mb/s; 36 Mb/s; 54 Mb/s
                    Bit Rates:6 Mb/s; 9 Mb/s; 12 Mb/s; 48 Mb/s
                    Mode:Master
                    Extra:tsf=00000000006b424f
                    Extra: Last beacon: 90ms ago
                    IE: Unknown: 000C416E64726F696441502D6264
                    IE: Unknown: 010882848B962430486C
                    IE: Unknown: 030101
                    IE: Unknown: 2A0100
                    IE: Unknown: 32040C121860
                    IE: IEEE 802.11i/WPA2 Version 1
                        Group Cipher : CCMP
                        Pairwise Ciphers (1) : CCMP
                        Authentication Suites (1) : PSK
                    IE: Unknown: 2D1A2D0017FFFF000000000000000000000000000000000000000000
                    IE: Unknown: 3D1601081100000000000000000000000000000000000000
                    IE: Unknown: 7F080400008001000040
                    IE: Unknown: DD1E00904C0408BF0C3258810FFAFF0000FAFF0000C0050001000000C3020010
                    IE: Unknown: DD090010180200001C0000
                    IE: Unknown: DD180050F2020101800003A4000027A4000042435E0062322F00
And here is the "ghost"  AndroidAP  showing up in subsequent scan, when the hotspot is actually 100% nonexistent because my phone is physically turned off:

Code: [Select]

         Cell 18 - Address: [redacted]
                    Channel:1
                    Frequency:2.412 GHz (Channel 1)
                    Quality=70/70  Signal level=-30 dBm 
                    Encryption key:on
                    ESSID:"AndroidAP-bd"
                    Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 18 Mb/s
                              24 Mb/s; 36 Mb/s; 54 Mb/s
                    Bit Rates:6 Mb/s; 9 Mb/s; 12 Mb/s; 48 Mb/s
                    Mode:Master
                    Extra:tsf=000000000268ac75
                    Extra: Last beacon: 7230ms ago
                    IE: Unknown: 000C416E64726F696441502D6264
                    IE: Unknown: 010882848B962430486C
                    IE: Unknown: 030101
                    IE: Unknown: 2A0100
                    IE: Unknown: 32040C121860
                    IE: IEEE 802.11i/WPA2 Version 1
                        Group Cipher : CCMP
                        Pairwise Ciphers (1) : CCMP
                        Authentication Suites (1) : PSK
                    IE: Unknown: 2D1A2D0017FFFF000000000000000000000000000000000000000000
                    IE: Unknown: 3D1601081500000000000000000000000000000000000000
                    IE: Unknown: 7F080400008001000040
                    IE: Unknown: DD1E00904C0408BF0C3258810FFAFF0000FAFF0000C0050001000000C3020010
                    IE: Unknown: DD090010180201001C0000
                    IE: Unknown: DD180050F2020101800003A4000027A4000042435E0062322F00

[GNUser]

I found this, but the answers only pertain to  wpa_supplicant  (not iwlist):
https://unix.stackexchange.com/questions/391237/wifi-scans-show-ssid-of-a-powered-off-network-for-several-scans-afterwards

[Rich]

Hi GNUser
Sounds like some kind of caching may be going on. Look at the time difference since the last updates:

Android up

Code: [Select]

Extra: Last beacon: 90ms ago
vs. Android down

Code: [Select]

Extra: Last beacon: 7230ms ago

[GNUser]

Yes, cache issue sounds quite likely. However,  iwlist  man page does not talk about how to ignore the cache.

I'd like to try scanning using  wpa_cli  since it seems  wpa_supplicant  has some relevant configuration options, but I'm stuck here:

Code: [Select]

$ sudo wpa_cli -i wlan0 scan
Failed to connect to non-global ctrl_ifname: wlan0  error: No such file or directory
Any idea how to work around the above?

[GNUser]

Best solution would be to figure out where  iwlist  keeps its cache, so that I can flush it before scanning.

[Rich]

Hi GNUser
From the man page:

scan[ning]
    Give the list of Access Points and Ad-Hoc cells in range, and optionally a whole bunch of information about them (ESSID, Quality, Frequency, Mode...). The type of information returned depends on what the card supports.
    Triggering scanning is a privileged operation (root only) and normal users can only read left-over scan results. By default, the way scanning is done (the scope of the scan) is dependant on the card and card settings.
    This command take optional arguments, however most drivers will ignore those. The option essid is used to specify a scan on a specific ESSID. The option last do not trigger a scan and read left-over scan results.

Notice what the last sentence says:

The option last do not trigger a scan and read left-over scan results.

Try adding another option after  scan.

[GNUser]

Code: [Select]

$ iwlist --help
Usage: iwlist [interface] scanning [essid NNN] [last]I think it means that if the option last (literal) is used, then no scan is performed and results come 100% from cache.
I'm not using the last option.
It seems that if last is omitted, then scan results include those of an actual scan plus what's in the cache.

There must be a way to either ignore the cache or else to flush it before scanning...

[GNUser]

I can confirm that adding the option last results in only cached results being shown.

Running  strace  does not reveal an obvious cache file:

Code: [Select]

$ strace -e trace=file iwlist wlan0 scanning last
execve("/usr/local/sbin/iwlist", ["iwlist", "wlan0", "scanning", "last"], [/* 27 vars */]) = 0
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/local/lib/libiw.so.29", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/lib/libm.so.6", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/lib/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
wlan0     Scan completed :
          Cell 01 - Address: 00:E1:6D:63:57:47
                    Channel:1
                    Frequency:2.412 GHz (Channel 1)
                    Quality=53/70  Signal level=-57 dBm 
                    Encryption key:off
                    ESSID:"WorkVisitor"
                    Bit Rates:5.5 Mb/s; 6 Mb/s; 9 Mb/s; 11 Mb/s; 12 Mb/s
                              18 Mb/s; 24 Mb/s; 36 Mb/s
                    Bit Rates:48 Mb/s; 54 Mb/s
                    Mode:Master
                    Extra:tsf=000003a70067d7f9
                    Extra: Last beacon: 752737ms ago
                    IE: Unknown: 000B41524D4356697369746F72
                    IE: Unknown: 01088B0C129618243048
                    IE: Unknown: 030101
                    IE: Unknown: 0706555320010B1E
                    IE: Unknown: 0B0505005E8D5B
                    IE: Unknown: 2A0100
                    IE: Unknown: 2D1A2C181BFFFF000000000000000000000000000000000000000000
                    IE: Unknown: 3202606C
                    IE: Unknown: 3D1601000500000000000000000000000000000000000000
                    IE: Unknown: 7F080010000001400001
                    IE: Unknown: 851E09008F000F00FF0359004C41502D41432D322D303600000000000500003A
                    IE: Unknown: 9606004096000800
                    IE: Unknown: DD180050F2020101800003A4000027A4000042435E0062322F00
                    IE: Unknown: DD06004096010104
                    IE: Unknown: DD050040960305
                    IE: Unknown: DD050040960B09
                    IE: Unknown: DD080040961301003401
                    IE: Unknown: DD050040961404

+++ exited with 0 +++
Where are the cached results hiding? If I can find them, then maybe I can flush them.

[Rich]

Hi GNUser

Code: [Select]

$ iwlist --help
Usage: iwlist [interface] scanning [essid NNN] [last]I think it means that if the option last (literal) is used, then no scan is performed and results come 100% from cache.
I'm not using the last option.
It seems that if last is omitted, then scan results include those of an actual scan plus what's in the cache. ...

Seems they forgot to list that in the man pages Synopsis. The word  last  showed up exactly one time in the man page.

Maybe do a search for something you can change (scan, iwlist, cache, wlan, etc.) in sysctl:

Code: [Select]

sudo sysctl -a 2>&1 | grep -i wlan

[GNUser]

I found that removing then reloading my wifi interface's kernel module clears the cache:

Code: [Select]

$ sudo modprobe -r ath9k
$ sudo modprobe ath9k
$ sudo ifconfig wlan0 up
$ sudo iwlist wlan0 scanning last
wlan0     No scan results # nothing in cache, nice!
$ sudo iwlist wlan0 scanning
-> no cached hotspots in scan result :)
It works, but it's a kludge. Does the above suggest where the cache might be hiding?

[jazzbiker]

Hi, GNUser!

It may be internal kernel buffer (

[GNUser]

Thanks, jazzbiker. Seems we're getting warmer.

Hopefully the kernel does not have one giant buffer for everything. There must be a sub-buffer with cached wifi scan results somewhere. I'll try grepping though /proc, but I suspect the buffer is binary and I'll get no hits.

[jazzbiker]

Wow, You monster! You want to destroy our beloved TinyCore! Stop immediately!!!

[GNUser]

Haha. TCL made me fearless. If the computer blows up in my face, a reboot magically fixes everything