nrf70 wifi WPA2-PSK association request has Cisco specific IEs : how to customise these?

RE: nrf70 wifi WPA2-PSK association request has Cisco specific IEs : how to customise these?

BrianW — Mon, 16 Mar 2026 11:56:41 GMT

[quote userid="134465" url="~/f/nordic-q-a/127205/nrf70-wifi-wpa2-psk-association-request-has-cisco-specific-ies-how-to-customise-these/562787"]

Samruddhi Jadhav said:
With Cisco AP: As the pcap is between AP and controller, we think that the AP itself might be adding these for the consumption of the controller. In order to confirm this, it would be great if an over the air sniffer (OTA) capture between DUT and AP can be provided.

I will try to get these to confirm if this is the case. Good to know however I didn't just miss code that adds them...

[/quote]

Confirmed that it was the Cisco AP adding these IEs, they are NOT present in the association request OTA!

thanks for the help

RE: nrf70 wifi WPA2-PSK association request has Cisco specific IEs : how to customise these?

Samruddhi Jadhav — Tue, 10 Mar 2026 09:17:46 GMT

Hi Brian,

Let me know when you get the OTA capture.

Best Regards,

Samruddhi

RE: nrf70 wifi WPA2-PSK association request has Cisco specific IEs : how to customise these?

BrianW — Mon, 09 Mar 2026 09:39:16 GMT

[quote userid="149179" url="~/f/nordic-q-a/127205/nrf70-wifi-wpa2-psk-association-request-has-cisco-specific-ies-how-to-customise-these/562729"]With Cisco AP: As the pcap is between AP and controller, we think that the AP itself might be adding these for the consumption of the controller. In order to confirm this, it would be great if an over the air sniffer (OTA) capture between DUT and AP can be provided. [/quote]

I will try to get these to confirm if this is the case. Good to know however I didn't just miss code that adds them...

[quote userid="149179" url="~/f/nordic-q-a/127205/nrf70-wifi-wpa2-psk-association-request-has-cisco-specific-ies-how-to-customise-these/562729"]With non-Cisco AP: There is no CAPWAP/Controller here, so how is the association request being confirmed? [/quote]

It is confirmed (by a Orange box in the office case), but indeed there are no Cisco IE in the association request. No problem in this case...

RE: nrf70 wifi WPA2-PSK association request has Cisco specific IEs : how to customise these?

Samruddhi Jadhav — Fri, 06 Mar 2026 13:31:17 GMT

Hi,

A quick update from the team. These Cisco IEs don't seem to be added by wpa_supplicant or UMAC.

With Cisco AP: As the pcap is between AP and controller, we think that the AP itself might be adding these for the consumption of the controller. In order to confirm this, it would be great if an over the air sniffer (OTA) capture between DUT and AP can be provided.

With non-Cisco AP: There is no CAPWAP/Controller here, so how is the association request being confirmed? Again, the OTA sniffer capture would be needed to check.

Best Regards,

Samruddhi

RE: nrf70 wifi WPA2-PSK association request has Cisco specific IEs : how to customise these?

BrianW — Tue, 03 Mar 2026 17:00:38 GMT

The PCAP output (via CAPWAP on the cisco AP)

Frame 810: Packet, 321 bytes on wire (2568 bits), 321 bytes captured (2568 bits)
Ethernet II, Src: CiscoMeraki_90:87:a0 (c4:14:a2:90:87:a0), Dst: VMware_8b:2f:18 (00:0c:29:8b:2f:18)
Internet Protocol Version 4, Src: 192.168.40.101, Dst: 192.168.40.7
User Datagram Protocol, Src Port: 5264, Dst Port: 5247
Control And Provisioning of Wireless Access Points - Data
IEEE 802.11 Association Request, Flags: ........
    Type/Subtype: Association Request (0x0000)
    Frame Control Field: 0x0000(Swapped)
    .000 0000 0011 0100 = Duration: 52 microseconds
    Receiver address: Cisco_10:cf:44 (70:bc:48:10:cf:44)
    Destination address: Cisco_10:cf:44 (70:bc:48:10:cf:44)
    Transmitter address: WTConsulting_1:00:97 (38:b8:eb:e1:00:97)
    Source address: WTConsulting_1:00:97 (38:b8:eb:e1:00:97)
    BSS Id: Cisco_10:cf:44 (70:bc:48:10:cf:44)
    .... .... .... 0000 = Fragment number: 0
    0000 0101 0010 .... = Sequence number: 82
    [WLAN Flags: ........]
IEEE 802.11 Wireless Management
    Fixed parameters (4 bytes)
    Tagged parameters (235 bytes)
        Tag: SSID parameter set: "XXXXXXXXX_2.4Ghtz"
            Tag Number: SSID parameter set (0)
            Tag length: 18
            SSID: "XXXXXXXXX_2.4Ghtz"
        Tag: Supported Rates 9, 12, 18, 24, 36, 48, 54, [Mbit/sec]
            Tag Number: Supported Rates (1)
            Tag length: 7
            Supported Rates: 9 (0x12)
            Supported Rates: 12 (0x18)
            Supported Rates: 18 (0x24)
            Supported Rates: 24 (0x30)
            Supported Rates: 36 (0x48)
            Supported Rates: 48 (0x60)
            Supported Rates: 54 (0x6c)
        Tag: Power Capability Min: 0, Max: 31
            Tag Number: Power Capability (33)
            Tag length: 2
            Minimum Transmit Power: 0 dBm
            Maximum Transmit Power: 31 dBm
        Tag: BSS Max Idle Period
            Tag Number: BSS Max Idle Period (90)
            Tag length: 3
            Max Idle Period (1000 TUs): 292
            Idle Options: 0x00
        Tag: RSN Information
            Tag Number: RSN Information (48)
            Tag length: 20
            RSN Version: 1
            Group Cipher Suite: 00:0f:ac (Ieee 802.11) AES (CCM)
            Pairwise Cipher Suite Count: 1
            Pairwise Cipher Suite List 00:0f:ac (Ieee 802.11) AES (CCM)
            Auth Key Management (AKM) Suite Count: 1
            Auth Key Management (AKM) List 00:0f:ac (Ieee 802.11) PSK
            RSN Capabilities: 0x0080
        Tag: Operating Mode Notification
            Tag Number: Operating Mode Notification (199)
            Tag length: 1
            Operating Mode Notification: 0x00
        Tag: HT Capabilities
            Tag Number: HT Capabilities (45)
            Tag length: 26
            HT Capabilities Info: 0x880c
            A-MPDU Parameters: 0x1e
            Rx Supported Modulation and Coding Scheme Set: MCS Set
            HT Extended Capabilities: 0x0000
            Transmit Beam Forming (TxBF) Capabilities: 0x00000000
            Antenna Selection (ASEL) Capabilities: 0x00
        Ext Tag: HE Capabilities
            Ext Tag length: 21 (Tag len: 22)
            Ext Tag Number: HE Capabilities (35)
            HE MAC Capabilities Information: 0x000000080003
            HE PHY Capabilities Information
            Supported HE-MCS and NSS Set
        Tag: RSN Information
            Tag Number: RSN Information (48)
            Tag length: 20
            RSN Version: 1
            Group Cipher Suite: 00:0f:ac (Ieee 802.11) AES (CCM)
            Pairwise Cipher Suite Count: 1
            Pairwise Cipher Suite List 00:0f:ac (Ieee 802.11) AES (CCM)
            Auth Key Management (AKM) Suite Count: 1
            Auth Key Management (AKM) List 00:0f:ac (Ieee 802.11) PSK
            RSN Capabilities: 0x0080
        Tag: Extended Capabilities (11 octets)
            Tag Number: Extended Capabilities (127)
            Tag length: 11
            Extended Capabilities: 0x00 (octet 1)
            Extended Capabilities: 0x00 (octet 2)
            Extended Capabilities: 0x00 (octet 3)
            Extended Capabilities: 0x00 (octet 4)
            Extended Capabilities: 0x00 (octet 5)
            Extended Capabilities: 0x00 (octet 6)
            Extended Capabilities: 0x40 (octet 7)
            Extended Capabilities: 0x0000 (octets 8 & 9)
            Extended Capabilities: 0x00 (octet 10)
            Extended Capabilities: 0x20 (octet 11)
        Tag: RM Enabled Capabilities (5 octets)
            Tag Number: RM Enabled Capabilities (70)
            Tag length: 5
            RM Capabilities: 0x70 (octet 1)
            RM Capabilities: 0x00 (octet 2)
            RM Capabilities: 0x00 (octet 3)
            RM Capabilities: 0x00 (octet 4)
            RM Capabilities: 0x00 (octet 5)
        Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Information Element
            Tag Number: Vendor Specific (221)
            Tag length: 7
            OUI: 00:50:f2 (Microsoft Corp.)
            Vendor Specific OUI Type: 2
            Type: WMM/WME (0x02)
            WME Subtype: Information Element (0)
            WME Version: 1
            WME QoS Info: 0x00
        Tag: Vendor Specific: Cisco Systems, Inc: Aironet Unknown (240)
            Tag Number: Vendor Specific (221)
            Tag length: 50
            OUI: 00:40:96 (Cisco Systems, Inc)
            Vendor Specific OUI Type: 240
            Aironet IE type: Unknown (240)
            Aironet IE data: 00000000170000007306000002000000560100000100000000000000000000000000000000000000000000000000
        Tag: Vendor Specific: Cisco Systems, Inc: Aironet Unknown (235)
            Tag Number: Vendor Specific (221)
            Tag length: 5
            OUI: 00:40:96 (Cisco Systems, Inc)
            Vendor Specific OUI Type: 235
            Aironet IE type: Unknown (235)
            Aironet IE data: 05
        Tag: Vendor Specific: Cisco Systems, Inc: Aironet Unknown (234)
            Tag Number: Vendor Specific (221)
            Tag length: 8
            OUI: 00:40:96 (Cisco Systems, Inc)
            Vendor Specific OUI Type: 234
            Aironet IE type: Unknown (234)
            Aironet IE data: 24000000

at the end of the association payload, you have:

Tag: Vendor Specific: Cisco Systems, Inc: Aironet Unknown (240)
Tag Number: Vendor Specific (221)
Tag length: 50
OUI: 00:40:96 (Cisco Systems, Inc)
Vendor Specific OUI Type: 240
Aironet IE type: Unknown (240)
Aironet IE data: 00000000170000007306000002000000560100000100000000000000000000000000000000000000000000000000

Tag: Vendor Specific: Cisco Systems, Inc: Aironet Unknown (235)
Tag Number: Vendor Specific (221)
Tag length: 5
OUI: 00:40:96 (Cisco Systems, Inc)
Vendor Specific OUI Type: 235
Aironet IE type: Unknown (235)
Aironet IE data: 05

Tag: Vendor Specific: Cisco Systems, Inc: Aironet Unknown (234)
Tag Number: Vendor Specific (221)
Tag length: 8
OUI: 00:40:96 (Cisco Systems, Inc)
Vendor Specific OUI Type: 234
Aironet IE type: Unknown (234)
Aironet IE data: 24000000

The device is mine, but I don't know how the cisco IEs get added in the wpa_supplicant code.... so that I can fix the version number in Aironet IE type 240 and the 'tag type' which is Aironet IE 235 (apparently)

RE: nrf70 wifi WPA2-PSK association request has Cisco specific IEs : how to customise these?

Samruddhi Jadhav — Tue, 03 Mar 2026 07:48:03 GMT

Hi Brian,

Is it possible for you to provide the sniffer captures for this?

Best Regards,

Samruddhi