fast & selective & active scanning

[Angelo .]

Hello people, i have a Senao 2511 Plus card (firmware 1.3.6) and i'm using 
HostAP drivers to implement experimental algorithms in scanning/handoff 
process.

I measured that an association to an access point, from the 
HFA384X_RID_JOINREQUEST command, to notification handled by 
hostap_info_process(), is about 14 ms long.... this is the good thing.

The bad one is that to do handoff, i have to scan for other access points, 
then i measured that to scan a single channel with a fixed essid using 
HFA384X_RID_HOSTSCAN command, card needs further on 80 ms!! this is too much 
considering that channels are 11 and that i have to periodically (1-2 
seconds) scan all of them.

Analyzing kismet and ethereal results, i see that probe request/response 
happen in less than 1 ms. when card is scanning, it sends a broadcast probe 
request and evidently waits for responses with a fixed timeout. i would be 
able to modify dinamically this timeout or to interrupt scanning a channel, 
i.e. when a probe request is received, but i fear that this code can be 
handled only by the firmware...
is it possible to forge probe requests in a channel, and handle responses, 
without loosing actual ap association in another channel?

Regards,

Angelo