OpenWiFi roam matrix — 188n-assoc-flush

67 trials · roam mode · 2026-09-15 18:27 · 7 min

What this measured

A single client was driven between every pair of BSSIDs in the testbed and each transition timed from the ROAM command to the CTRL-EVENT-CONNECTED event. Trials were interleaved across pairs rather than run in blocks, so anything drifting over the run spreads across all groups instead of loading onto one.

The comparison that matters is a cross-radio roam within one AP against the same 2.4↔ 5 GHz transition between two APs. The client does identical work either way; the only difference is whether the two radios share one ath11k_base.

Dataplane after the roam

Every completed roam is followed by a real DHCP exchange from the client. This is a forwarding test, not a DHCP test: sdan drops a downstream frame whose destination MAC is absent from the MAC table for that VLAN, so a station that is associated and authorized but missing from the table receives nothing — the server answers every message and the client keeps asking. That failure is only visible from the client.

By roam class

By BSSID pair

Failures

stayed_on_source the client never left the old BSS. landed_on_other it moved somewhere unasked. ended_disconnected it fell off entirely. roam_rejected wpa_supplicant refused the command, usually a target missing from the scan cache.

Testbed

SSID

OW mPSK WPA2

Client MAC

02:03:7f:12:97:21

Client iface

sta0

Trials per pair

5

Shuffle seed

1

Roam cap (s)

25.0

Chipset topology is read from sysfs, not inferred from the model name: on IPQ6018 both phy0 and phy1 resolve to soc/c000000.wifi, while on IPQ5018 phy1 resolves to soc:wifi1@c000000 — a separate device with its own peer table.

Method

• Timing is event-driven: a second control socket is ATTACHed and the CTRL-EVENT-CONNECTED event timestamped on arrival, so the figure is not quantised by a polling interval.
• Each trial is preceded by an unmeasured park onto the source BSSID, with wpa_supplicant’s BSSID ignore-list cleared. Without that clear, a BSSID that fails once stops being attempted and its measured failure rate comes out lower than the truth.
• The BSS cache is seeded by one scan and held for the run, so no trial re-scans and none can fail merely because a cache entry expired.
• A transition longer than 25.0 s is recorded as not completed and classified by what the client did instead.

All trials