wpa_supplicant can't find hidden SSID

[planetf1]

On 19/03/09 18:23, Dan Williams wrote:
> It would be either one of two thing then:
>
> 1) driver is dropping probe requests internally
> 2) AP isn't responding correctly to probes
>
> Unfortunately, the second probably requires sniffing frames over the
> air.  The first may require extra debugging in the driver.
>    
 From dmesg during the scan I can see
  * the direct scan requested
  * a choice of 11 channels chosen (1..11)
  * this taking just over 120ms per channel

The only log info from ch. 11 (which is the strongest correct AP) is
iwl3945: I iwl3945_rx_scan_start_notif Scan start: 11 [802.11bg] (TSF: 
0x00000000:041CDE03) - 1 (beacon timer 2701148669)
iwl3945: I iwl3945_rx_handle r = 64, i = 63, REPLY_3945_RX, 0x1b
iwl3945: I iwl3945_rx_handle r = 65, i = 64, SCAN_RESULTS_NOTIFICATION, 0x83
iwl3945: I iwl3945_rx_scan_results_notif Scan ch.res: 11 [802.11bg] 
(TSF: 0x00000000:041EBE0C) - 3 elapsed=122889 usec (124ms since last)
iwl3945: I iwl3945_rx_handle r = 66, i = 65, SCAN_COMPLETE_NOTIFICATION, 
0x84

Ramping up debug more I managed to get a response frame:

iwl data: 00000000: 80 00 00 00 ff ff ff ff ff ff 00 1b 90 74 34 40  
.............t4@
iwl data: 00000010: 00 1b 90 74 34 40 e0 cf 8e 01 43 82 c6 00 00 00  
...t4 at ....C.....
iwl data: 00000020: 64 00 31 04 00 01 00 01 08 82 84 8b 0c 12 96 18  
d.1.............
iwl data: 00000030: 24 03 01 0b 05 04 00 02 00 00 07 06 47 42 49 01  
$...........GBI.
iwl data: 00000040: 0d 17 2a 01 00 30 14 01 00 00 0f ac 05 01 00 00  
..*..0..........
iwl data: 00000050: 0f ac 04 01 00 00 0f ac 01 28 00 32 04 30 48 60  
.........(.2.0H`
iwl data: 00000060: 6c 85 1e 01 00 89 00 1f 00 ff 03 19 00 68 75 72  
l............hur
iwl data: 00000070: 2d 61 70 2d 61 34 6c 36 30 00 00 00 00 02 00 00  
-ap-a4l60.......
iwl data: 00000080: 27 dd 18 00 50 f2 01 01 00 00 50 f2 05 01 00 00  
'...P.....P.....
iwl data: 00000090: 50 f2 02 01 00 00 50 f2 01 28 00 dd 06 00 40 96  
P.....P..(.... at .
iwl data: 000000a0: 01 01 00 dd 05 00 40 96 03 05 dd 05 00 40 96 0b  
...... at ...... at ..
iwl data: 000000b0: 09 dd 05 00 40 96 14 01 dd 18 00 50 f2 02 01 01  
.... at ......P....
iwl data: 000000c0: 81 00 03 a5 00 00 27 a5 00 00 42 54 bc 00 62 43  
......'...BT..bC
iwl data: 000000d0: 66 00

This is I think the right AP... but not a clue on interpretation. 
There's a few of these, as expected.

So we got a frame, but was the response what was needed? Ummm.