iwlist scan not working with host_roaming?

[markus.baumeister at philips.com]

Hello,

I use hostap 0.0.3 on two APs as well as on the client. Setting a specific 
AP to associate to with

prism2_param wlan0 host_roaming 1
iwconfig wlan0 ap xx.yy.......

works, but afterwards iwlist wlan0 scan shows very strange behaviour by 
listing one AP twice and not showing the other. Example output:

----- snip ------
wlan0     Scan completed :
          Cell 01 - Address: 00:09:5B:34:FC:51
                    ESSID:"MyMedLAN"
                    Mode:Master
                    Frequency:2.432GHz
                    Quality:0/92  Signal level:-94 dBm  Noise level:-99 
dBm
                    Encryption key:on
                    Bit Rate:1Mb/s
                    Bit Rate:2Mb/s
                    Bit Rate:5.5Mb/s
                    Bit Rate:11Mb/s
          Cell 02 - Address: 00:09:5B:34:FC:51
                    ESSID:"MyMedLAN"
                    Mode:Master
                    Frequency:2.432GHz
                    Quality:0/92  Signal level:-92 dBm  Noise level:-99 
dBm
                    Encryption key:on
                    Bit Rate:1Mb/s
                    Bit Rate:2Mb/s
                    Bit Rate:5.5Mb/s
                    Bit Rate:11Mb/s
--------- snip -----

Actually there is a second AP on channel 3 (see below). [Also the signal 
level given is different from the one shown by iwconfig (-80 to -85 dBm).]
The dmesg output for this is:

-------- snip -------
hostap_cs: 0.0.3 - 2003-05-18 (Jouni Malinen <jkmaline at cc.hut.fi>)
hostap_cs: setting Vcc=33 (constant)
hostap_cs: CS_EVENT_CARD_INSERTION
.....
scanning siwscan channels 3fffh 
wlan0: ScanResults: Reserved=0x35ba ScanReason=1
wlan0: Preferred AP BSSID 00:09:5b:34:fc:51
wlan0: using preferred AP selection
wlan0: JoinRequest: BSSID=00:09:5b:34:fc:51 channel=5
Scan len = 128 (entry=62)
Scan result translation succeeded (length=232)
------ snip ---

The double appearance of the AP doesn't happen with host_roaming = 0, but 
there is a second way to avoid it; Scanning twice quickly after another, 
result of second iwlist wlan0 scan is then:
---- snip ----
wlan0     Scan completed :
          Cell 01 - Address: 00:09:5B:34:FC:51
                    ESSID:"MyMedLAN"
                    Mode:Master
                    Frequency:2.432GHz
                    Quality:0/92  Signal level:-93 dBm  Noise level:-99 
dBm
                    Encryption key:on
                    Bit Rate:1Mb/s
                    Bit Rate:2Mb/s
                    Bit Rate:5.5Mb/s
                    Bit Rate:11Mb/s
          Cell 02 - Address: 00:09:5B:34:FE:78
                    ESSID:"MyMedLAN"
                    Mode:Master
                    Frequency:2.422GHz
                    Quality:0/92  Signal level:-94 dBm  Noise level:-100 
dBm
                    Encryption key:on
                    Bit Rate:1Mb/s
                    Bit Rate:2Mb/s
                    Bit Rate:5.5Mb/s
                    Bit Rate:11Mb/s
------- snip -----

The corresponding dmesg excerpt might shed some light on this:

-------- snip ------
scanning siwscan channels 3fffh 
wlan0: ScanResults: Reserved=0x437b ScanReason=1
wlan0: Preferred AP BSSID 00:09:5b:34:fc:51
wlan0: using preferred AP selection
wlan0: JoinRequest: BSSID=00:09:5b:34:fc:51 channel=5
Scan len = 128 (entry=62)
Scan result translation succeeded (length=232)
scanning siwscan channels 3fffh 
wlan0: ScanResults: Reserved=0x4389 ScanReason=1
wlan0: last join request has not yet been completed - waiting for it 
before issuing new one
Scan len = 128 (entry=62)
Scan result translation succeeded (length=232)
------ snip -----

(Remeber: First scan gives wrong results, second one correct ones.)
This looks as if the scanning will give wrong results if an association to 
the preferred AP is in place.

hostap 0.0.3 (also occured with 0.0.2)
Kernel 2.4.20
Netgear MA401 cards, old firmware STA 1.3.6, updated to STA 1.5.6 but no 
change

Kind regards
        Markus Baumeister