In message <20051018230552.GW1513@che.ojctech.com>, David Young writes:
>
>--SCOJXUq1iwCn05li
>Content-Type: text/plain; charset=us-ascii
>Content-Disposition: inline
>
>On Tue, Oct 18, 2005 at 05:00:52PM -0400, Steven M. Bellovin wrote:
>> Sometimes, it works very well; in my house over the weekend (two access 
>> points, with WEP), it worked flawlessly.  Other places, it's worked 
>> poorly or not at all, so much so that I'm contemplating starting to 
>> travel with a wi card again.
>
>Steve,
>
>I think I have figured it out by re-reading some logs Perry sent me.
>I will tell you what I think is happening.  When ath(4) doesn't receive
>the AP's beacon for a while, it times out and tries to reassociate with
>the AP.  In a zone where there's 802.11 congestion, your ath might
>miss a lot of beacons and time-out often.  Congestion may also cause
>reassociation to fail.  If reassociation fails, then ath will scan
>for access points again.  This is where things go haywire: a bug in
>the scanning code makes ath disregard your AP, because it failed to
>associate with it, until the AP is flushed from the scan table with
>ifconfig down/up.

That is certainly very consistent with what I've observed.

>
>You and Perry should try this patch.
>
I leave on a trip tomorrow, which means that I'll build a kernel with 
that patch but *not* install it...

>
>-- 
>David Young             OJC Technologies
>dyoung@ojctech.com      Urbana, IL * (217) 278-3933
>
>--SCOJXUq1iwCn05li
>Content-Type: text/plain; charset=us-ascii
>Content-Disposition: attachment; filename=scan-patch
>
>Index: ieee80211_node.c
>===================================================================
>RCS file: /cvsroot/src/sys/net80211/ieee80211_node.c,v
>retrieving revision 1.44
>diff -u -u -r1.44 ieee80211_node.c
>--- ieee80211_node.c	25 Sep 2005 00:03:06 -0000	1.44
>+++ ieee80211_node.c	18 Oct 2005 22:18:24 -0000
>@@ -619,7 +619,7 @@
> ieee80211_end_scan(struct ieee80211com *ic)
> {
> 	struct ieee80211_node_table *nt = &ic->ic_scan;
>-	struct ieee80211_node *ni, *selbs;
>+	struct ieee80211_node *next_ni, *ni, *selbs;
> 
> 	ieee80211_cancel_scan(ic);
> 	ieee80211_notify_scan_done(ic);
>@@ -707,7 +707,8 @@
> 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_SCAN, "\t%s\n",
> 	    "macaddr          bssid         chan  rssi rate flag  wep  essid");
> 	IEEE80211_NODE_LOCK(nt);
>-	TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
>+	for (ni = TAILQ_FIRST(&nt->nt_node); ni != NULL; ni = next_ni) {
>+		next_ni = TAILQ_NEXT(ni, ni_list);
> 		if (ni->ni_fails) {
> 			/*
> 			 * The configuration of the access points may change
>@@ -718,11 +719,8 @@
> 				"%s: skip scan candidate %s, fails %u\n",
> 				__func__, ether_sprintf(ni->ni_macaddr),
> 				ni->ni_fails);
>-			ni->ni_fails++;
>-#if 0
> 			if (ni->ni_fails++ > 2)
> 				ieee80211_free_node(ni);
>-#endif
> 			continue;
> 		}
> 		if (ieee80211_match_bss(ic, ni) == 0) {
>
>--SCOJXUq1iwCn05li--
>


		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb