open80211s HOWTO

This page explains how to set up a mesh network using open80211s and a supported driver.

Note: at this time, this HOWTO assumes that you are not running a WiFi manager such as NetworkManager. Please kill or otherwise stop NetworkManager or similar software before setting up your mesh interfaces or tell it to ignore the device that you plan to use for mesh.


Software Requirements

In order to set up a mesh you'll need a kernel and a few packages. Internally we use a master project ( distro11s) that can build a full mesh node from the different repositories listed below. You are welcome to try that.

o11s works on OpenWrt - see Building for OpenWrt

Or you can fetch the different components individually:

For Open Mesh

An open mesh is one where all peers with compatible configuration are allowed to join the mesh. Essentially this means that just the Mesh ID and the channel must match.

The kernel

Get the wireless-testing kernel:


If you are trying this release within a few days of release date all our patches may not be in wireless-testing yet. In that case, just clone the kernel from here:


Configure the kernel including the mac80211 stack with mesh capabilities (CONFIG_MAC80211, CONFIG_MAC80211_MESH) and enable the driver(s) that you need, for example the zd1211-rw driver (CONFIG_ZD1211RW). Compile and install on your target. Here are instructions for Ubuntu?.

You also have the option of using  compat-wireless instead of building the kernel or you may also use the  2.6.26 or later mainline kernel. Using wireless-testing is strongly recommended as it represents the latest development and driver support.


Follow the instructions at  iw documentation page to build the latest version of iw from source or use a recent released version of iw.

For Secured Mesh

In a secured mesh, all peers must share a secret password. Authentication is established via the Simultaneous Authentication of Equals protocol. Key derivation and cipher suite negotiation is done via the Authenticated Mesh Peering Exchange. Both protocols are specified in the 802.11s amendment.

In addition to the basement requirements above you will need the following:


See this section


Get our fork of authsae from here


authsae depends on openssl. You'll have to edit linux/Makefile to tell it where to find it.

Then build:

$cc -g -DLINUX -Wall -Werror -I..   -c -o meshd.o meshd.c
cc -g -DLINUX -Wall -Werror -I..   -c -o ../common.o ../common.c
cc -g -DLINUX -Wall -Werror -I..   -c -o ../sae.o ../sae.c
cc -g -DLINUX -Wall -Werror -I..   -c -o ../service.o ../service.c
cc -g -DLINUX -Wall -Werror -I..   -c -o ../ampe.o ../ampe.c
cc -o meshd meshd.o ../common.o ../sae.o ../service.o ../ampe.o ../crypto/aes_siv.o -L. -lcrypto -lconfig
cc -g -DLINUX -Wall -Werror -I..   -c -o meshd-nl80211.o meshd-nl80211.c
cc -g -DLINUX -Wall -Werror -I..   -c -o nlutils.o nlutils.c
ar rcs libsae.a ../common.o ../sae.o ../service.o ../ampe.o ../crypto/aes_siv.o
cc -o meshd-nl80211 meshd-nl80211.o nlutils.o libsae.a -L. -lsae -lnl -lnl-genl -lcrypto  -lconfig
cc -g -DLINUX -Wall -Werror -I..   -c -o mon.o mon.c
cc mon.o ../service.o ../common.o -o mon

Open Mesh Setup

Each mesh node needs to be configured as follows:

  • Boot several nodes with the compiled kernel and with iw properly installed.
  • Choose a mesh ID. The mesh ID is a string that will be used in the mesh node beacons. Only mesh points with the same mesh id will be able to communicate with each other. The mesh id is a maximum of 32 bytes long. In this document, we refer to the mesh id as $MESH_ID.
  • Add a new mesh interface for the wlanN device on each node. You can choose the name of the mesh interface. "mesh" is a popular choice. In this document, we refer to the mesh interface as $MESH_IFACE.
# iw dev wlan0 interface add $MESH_IFACE type mp

A new interface will be created:

# ifconfig -a | grep mesh
mesh      Link encap:Ethernet  HWaddr 00:18:39:14:48:B5  

Note: depending on your Linux distribution, you may see  a slightly different name for the mesh interface.

All mesh interfaces start by default in channel 1. The channel can be changed with

# iw dev $MESH_IFACE set channel <channel>

Bring up your $MESH_IFACE interface and assign an IP

# ifconfig $MESH_IFACE <ip_addr>

For this tutorial, let's assume that our mesh nodes are assigned addresses in the subnet.

# ifconfig $MESH_IFACE

Join a mesh network:

# iw dev $MESH_IFACE mesh join $MESH_ID
  • In the default configuration, mesh points will automatically attempt to create peer links will all other mesh nodes with the same mesh ID. You can examine which peer links have been established with the iw dev $MESH_IFACE station dump command:
# iw dev $MESH_IFACE station dump
Station 00:15:6d:84:14:10 (on mesh)
	inactive time:	1320 ms
	rx bytes:	352
	rx packets:	4
	tx bytes:	174
	tx packets:	2
	signal:  	-61 dBm
	tx bitrate:	1.0 MBit/s
	mesh llid:	32577
	mesh plid:	15969
	mesh plink:	ESTAB
Station 00:15:6d:84:14:09 (on mesh)
	inactive time:	3370 ms
	rx bytes:	1064
	rx packets:	12
	tx bytes:	545
	tx packets:	7
	signal:  	-53 dBm
	tx bitrate:	1.0 MBit/s
	mesh llid:	41036
	mesh plid:	24435
	mesh plink:	ESTAB

Each Station stanza in the station dump output represents a mesh node with whom we have a peer link. The first line shows the MAC address of the mesh node. The mesh plink field reports the state of the peer link with this mesh node. When this value is ESTAB, direct communication with this mesh node is possible.

  • You should now be able to ping any node in the mesh. After doing that you can use arp and iw to inspect the arp table and path table. This will reveal where the packet was actually sent in order to get to its destination.
192-168-3-80:~# ping -c 2
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=64 time=8.85 ms
64 bytes from icmp_seq=2 ttl=64 time=3.42 ms

192-168-3-80:~# arp
? ( at 00:15:6d:84:14:0e [ether]  on mesh

192-168-3-80:~# iw dev $MESH_IFACE mpath dump
00:15:6d:84:14:10 00:15:6d:84:14:10 mesh	0	228 	0	2196731904	0	0	0x10
00:15:6d:84:14:0e 00:15:6d:84:14:10 mesh	2	456 	0	2196731904	360	0	0x4
00:15:6d:84:14:09 00:15:6d:84:14:09 mesh	1	8193	0	2196731904	0	0	0x10

The arp table shows the hardware address of the destination node. This is useful for interpreting the output of the mpath dump command. The mpath dump shows the table that the mesh stack uses to route packets. This table is constructed as the mesh stack successfully establishes paths to destinations in the mesh. Each output line shows the destination address in the first column and the next hop address in the second column. Look up the destination address of our ping packet (00:15:6d:84:14:0e) in this table. You can see that the next hop is 00:15:6d:84:14:10, revealing that the packet will not be sent directly to the destination. Instead, it will be sent to 00:15:6d:84:14:10 who will presumably forward it on appropriately. In contrast, if the destination of the packet were 00:15:6d:84:14:09, the packet would be sent directly to that node. This is because the path table reports the same address for the destination and next hop.

Each entry in the mpath dump has several trailing fields after the destination and next hop addresses. For more information on the meaning of these fields, see the mpath page. Also, be sure to check the the driver status page for any known issues related to your driver.

Et voilà!

Secured Mesh Setup

Everything you need to create an authenticated mesh is listed in Requirements. authsae will handle all authentication and peering for us.

Edit authsae.conf to enter your mesh password:

/* this is a comment */
    debug = 480;
    password = "thisisreallysecret";
    group = [19, 26, 21, 25, 20];
    blacklist = 5;
    thresh = 5;
    lifetime = 3600;
       meshid = "byteme";
       interface = "mesh0";
       passive = 0;
       debug = 1;
       mediaopt = 1;
       band = "11g";
       channel = 1;

Then on each node:

$AUTHSAE_DIR/linux/meshd-nl80211 -c $AUTHSAE_CONF -s $MESHID -i $MESH_IFACE

After authentication and peering completes you should see authenticated mesh peers:

$ iw $MESH_IFACE station dump 
Station 00:02:03:04:00:00 (on mesh0)
	inactive time:	608 ms
	rx bytes:	26967
	rx packets:	535
	tx bytes:	1182
	tx packets:	10
	tx retries:	0
	tx failed:	0
	signal:  	-30 dBm
	signal avg:	-30 dBm
	tx bitrate:	1.0 MBit/s
	mesh llid:	0
	mesh plid:	0
	mesh plink:	ESTAB

High Throughput

If you have an 11n capable card, simply set the channel type to HT20 or HT40+/HT40-, as allowed by /sys/kernel/debug/ieee80211/phy0/ht40allow_map, to enable high throughput:

iw mesh0 set channel 149 HT40+

Advanced Tinkering

  • You can modify the mesh path table with these commands:
    • iw dev $MESH_IFACE mpath del $DST_ADDR: to delete a mesh path entry.
    • iw dev $MESH_IFACE mpath new $DST_ADDR next_hop $NEXTHOP_ADDR to force a specific network topology.
  • You can modify the mesh peer links table with these commands:
    • iw dev $MESH_IFACE station dump: list all the plinks.
    • iw dev $MESH_IFACE station set $HW_ADDR plink_action [open|block]: trigers a specific peer link stablishment process or blocks a specific peer link.
    • iw dev $MESH_IFACE station del $HW_ADDR: deletes a peer link from the peer table.
  • You can get and set mesh parameters using the "mesh_param" command in iw. For example, to change the mesh TTL value (which defaults to 5), one would:
    # iw dev $MESH_IFACE get mesh_param mesh_ttl
    # iw dev $MESH_IFACE set mesh_param mesh_ttl 3

The following mesh parameters can be inspected and set:

  • mesh_retry_timeout
  • mesh_confirm_timeout
  • mesh_holding_timeout
  • mesh_max_peer_links
  • mesh_max_retries
  • mesh_ttl
  • mesh_auto_open_plinks
  • mesh_hwmp_max_preq_retries
  • mesh_path_refresh_time
  • mesh_min_discovery_timeout
  • mesh_hwmp_active_path_timeout
  • mesh_hwmp_preq_min_interval
  • mesh_hwmp_net_diameter_traversal_time
  • mesh_hwmp_rootmode
  • mesh_hwmp_rann_interval
  • mesh_gate_announcements


Our wireshark mesh patches have been accepted upstream (since r38281), so you just need to get a recent wireshark version to dissect mesh (see here how to get it

Open Mesh

For an open mesh network, Wireshark recognizes and dissects the data within the mesh frames

Secure Mesh

For this scenario, Wireshark can only parse the mesh frames (because the data is encrypted)

Mesh Gate

A mesh gate is just a mesh node that connects to an external network. To bring up a mesh gate we need to setup up a bridge between a mesh interface and, for example, an Ethernet interface.

1. Bring up a mesh interface as described in the "Testing" section above.

mpp$ iw dev wlan0 interface add $MESH_IFACE type mp mesh_id ${MESH_ID}
mpp$ ifconfig $MESH_IFACE up

2. Add this new interface and your ethN interface to a new bridge:

mpp$ brctl addbr br0
mpp$ brctl stp br0 off
mpp$ brctl addif br0 eth1
mpp$ brctl addif br0 mesh
mpp$ ifconfig $MESH_IFACE down
mpp$ ifconfig eth1 down
mpp$ ifconfig $MESH_IFACE up
mpp$ ifconfig eth1 up
mpp$ ifconfig br0 ${MESH_IP}

If you are having problem setting up the bridge, here is a great howto:  Ethernet Bridge + netfilter HOWTO

3. Enable gate announcements

You can configure gates to advertise their presence on the mesh. We do this by including those advertisements in root announcements. To enable this functionality you must make your gate a root node and enable gate announcements:

iw mesh set mesh_param mesh_hwmp_rootmode=1
iw mesh set mesh_param mesh_gate_announcements=1

Once you do this, all the nodes in your mesh will proactively create paths to your gate. Mesh nodes will send to gate(s) all traffic to those destinations that could not be resolved in the mesh.

Gates introduce some management and data traffic overhead. You should keep the number of gates down on your network.

 Comments? Questions? Praise? Flames?