hostapd

hostapd makes a radio an access point. Its config file names the interface, the ssid, the channel and the security: wpa=2 with wpa_key_mgmt=WPA-PSK and a wpa_passphrase for WPA2-PSK, or wpa_key_mgmt=SAE with an sae_password and ieee80211w=2 for WPA3 (which requires 802.11w protected management frames); leaving the WPA lines out makes an open network. Started with -B it runs in the background and the radio leaves scanning to beacon the SSID, which iw dev wlan0 info then shows as type AP. The radio's hardware address is the BSSID clients lock onto, so pinning it with ip link set wlan0 address before starting gives the AP a known BSSID.

hostapd command usage

hostapd -B [-f LOGFILE] CONFIG

Options

-B

run in the background as a daemon

-f /var/log/hostapd.log

write the log to a file

CONFIG

the config file: interface, ssid, channel and the WPA settings

hostapd examples

hostapd -B -f /var/log/hostapd.log /etc/hostapd.conf

Starts the access point in the background with the given config.

hostapd -B /etc/hostapd.conf

Starts the access point, logging to the console.

Pitfalls

• A radio runs one AP for its whole life: hostapd cannot be restarted into a new mode on the same virtual radio without the radio reporting the resource busy, so a WPA2-to-WPA3 change means a second AP on its own radio.
• WPA3 (wpa_key_mgmt=SAE) needs ieee80211w=2, or the association is refused.

Run it on real machines