BSSID sweep: OpenWiFi 5.1.0‑0.006 lab fleet

2026‑10‑05, 06:04–06:08 MDT. One sensor joined every 2.4 and 5 GHz BSSID of OW mPSK WPA2 on five lab APs, one at a time, and checked that a client on it gets an address and reaches the Internet.

Result: 10/10

Pass = associated to that exact BSSID, leased by DHCP, and answered a ping to 1.1.1.1 in each of 15 consecutive seconds.

AP	Band	Channel	BSSID	Lease	DHCP	1.1.1.1	Result
WF189	5 GHz	44 (5220)	d4:ba:ba:a3:15:ab	10.20.2.2	0.38 s	15/15	pass
WF660a	5 GHz	149 (5745)	d4:ba:ba:a1:8c:01	10.20.2.2	0.42 s	15/15	pass
WF186h	5 GHz	157 (5785)	d4:ba:ba:a4:05:cb	10.20.2.2	0.37 s	15/15	pass
WF188n	5 GHz	157 (5785)	d4:ba:ba:ab:ba:aa	10.20.2.2	0.35 s	15/15	pass
EAP111	5 GHz	149 (5745)	22:1a:e3:db:53:68	10.20.2.2	0.44 s	15/15	pass
WF189	2.4 GHz	6 (2437)	d4:ba:ba:a3:15:aa	10.20.2.3	0.47 s	15/15	pass
WF660a	2.4 GHz	6 (2437)	d4:ba:ba:a1:8c:02	10.20.2.3	0.42 s	15/15	pass
WF186h	2.4 GHz	11 (2462)	d4:ba:ba:a4:05:ca	10.20.2.3	0.44 s	15/15	pass
WF188n	2.4 GHz	6 (2437)	d4:ba:ba:ab:ba:ab	10.20.2.3	2.59 s	15/15	pass
EAP111	2.4 GHz	11 (2462)	a0:1a:e3:db:53:68	10.20.2.3	0.38 s	15/15	pass

Every lease came from 10.20.2.1 on VLAN 301 (10.20.2.0/24). The sensor kept one MAC per band, so it held the same address on every AP within a band.

Versions under test

Component	Version
rXg	build 16.787-5-hbhowksdan51update
AP firmware	rgnets-5.1.0-0.006 · ApNos-92cbcec63 · OpenWrt 25.12.3 r32912-6639b15f62
rg_wss_client	1.0.40
rxg_sdan	1.18-8-gde62a9f (tarball 1.18-alpha-de62a9f)

AP	rXg id	IP	Firmware	rg_wss_client	rxg_sdan build loaded
CIG WF189	24662	172.16.11.100	ApNos-92cbcec63	1.0.40	ipq53xx/generic 6.6.88 25.12
Cigtech WF-660a	16652	172.16.11.102	ApNos-92cbcec63	1.0.40	ipq60xx/generic 5.4.164 25.12
CIG WF186h	24670	172.16.11.103	ApNos-92cbcec63	1.0.40	ipq50xx/generic 5.4.164 25.12
Cigtech WF-188n	24667	172.16.11.104	ApNos-92cbcec63	1.0.40	ipq60xx/generic 5.4.164 25.12
Edgecore EAP111	24660	172.16.11.105	ApNos-92cbcec63	1.0.40	mediatek/filogic 6.12.85 25.12

Read from each AP and the rXg shortly after the sweep. Every AP's uptime covered the sweep window, so nothing rebooted or upgraded in between.

Scope.

One SSID, one mPSK key. 802.1X, wired RADIUS on LAN ports, and per‑key dynamic VLANs were not tested.
6 GHz is excluded: the WF‑189 sensor's 6 GHz client scan is blocked by an ath12k driver bug.
The second WF‑188n (rXg id 24668) was offline.
An earlier sweep the same morning had one WF186h 5 GHz failure (associated, no DHCP answer within 8.6 s) that did not recur. That run's 2.4 GHz results were invalid (a sensor setup bug between bands) and are not counted.

Method

Sensor: a second CIG WF189 (d4:ba:ba:a2:e8:78, firmware ApNos-92cbcec63) with rgminiloader disabled so the rXg cannot reconfigure it, its tri‑band MLO radio split per band (mlo_capable=0), and no SSIDs of its own. Targets were read live from each AP's radios, so the sweep tested what was actually on the air. For each BSSID, sensord placed a STA on that exact BSSID, isolated it in its own Linux VRF via rg_wss_client's production VrfDomain, leased by DHCP, and sent one ICMP echo per second from a raw socket bound to the STA with SO_BINDTODEVICE, so a reply proves the path through that association rather than the sensor's own uplink. Driver: ~/lab/sensor/sweep.py; raw results: runs/sweep-20261005-060423/results.jsonl.