NL80211

nl80211 is the Linux kernel netlink API for configuring and monitoring wireless LAN devices. It is the user-space interface to the mac80211 subsystem (via cfg80211) and provides a structured, event-driven way to control interfaces, trigger scans, and manage connections. It is the modern replacement for Wireless Extensions.

As a netlink family, programs communicate with the kernel using a defined set of commands and attributes to create or remove virtual interfaces (station, AP, monitor, mesh), trigger scans, connect or disconnect, and configure channels, power, and security. It supports multiple virtual interfaces per device and asynchronous operation, enabling flexible wireless configurations and state reporting.

nl80211 works with cfg80211 and mac80211 to implement 802.11 management, regulatory domain handling, and driver features. It exposes capabilities such as channel selection, HT/VHT support, mesh networking, P2P (Wi‑Fi Direct) operations, and monitor mode, along with attributes for SSIDs, BSS IDs, frequencies, and related link data.

Events and data are delivered via netlink; the kernel posts messages for new scan results, associations, disconnections, and state changes. User-space tools parse these events to manage connections or update interfaces and user interfaces. Tools such as iw, wpa_supplicant, hostapd, and NetworkManager rely on nl80211 to configure devices and respond to wireless state changes.

Support for nl80211 varies by device and driver. It is the standard interface on Linux wireless hardware that uses the mac80211/cfg80211 stack, while some legacy drivers may offer limited support. Commands typically require elevated privileges, reflecting the sensitive nature of wireless configuration.