How to use wpa_cli command

wpa_cli is included in the wpa_supplicant package. It can check status and change configuration, including trigger events and passphrases when connecting to wireless networks.

Using wpa_cli

wpa_cli operates in two modes: as a command-line interpreter, such as wpa_cli -i eth1 scan, or as an interactive shell, such as wpa_cli -i eth1. Commands can be abbreviated. For example, use wpa_cli -i eth1 stat instead of wpa_cli -i eth1 status to check status. The abbreviations are listed in the table below.

Full command	Short command	Description
status	stat	displays the current connection status
disconnect	disc	prevents wpa_supplicant from connecting to any access point
quit	q	exits wpa_cli
terminate	term	kills wpa_supplicant
reconfigure	recon	reloads wpa_supplicant with the configuration file supplied (-c parameter)
scan	scan	scans for available access points (only scans it, doesn’t display anything)
scan_display	scan_d	displays the results of the last scan
list_networks	list_n	displays a list of configured networks and their status (active or not, enabled or disabled)
select_network	select_n	select a network among those defined to initiate a connection (ie select_network 0)
enable_network	enable_n	makes a configured network available for selection (ie enable_network 0)
disable_network	disable_n	makes a configured network unavailable for selection (ie disable_network 0)
remove_network	remove_n	removes a network and its configuration from the list (ie remove_network 0)
add_network	add_n	adds a new network to the list. Its id will be created automatically
set_network	set_n	shows a very short list of available options to configure a network when supplied with no parameters.See next section for a list of extremely useful parameters to be used with set_network and get_network.
get_network	get_n	displays the required parameter for the specified network. See next section for a list of parameters
save_config	save_c	saves the configuration

Using wpa_cli with set_network is shown in the following example.

set_network <network id> <key> <parameter> [<parameter>] 

Using wpa_cli with get_network is shown in the following example.

get_network <network id> <key> 

The key parameters for set_network and get_network are detailed in the table below.

Key	Description	Parameters
ssid	Access point name	string
id_str	String identifying the network	string
priority	Connection priority over other APs	number (0 being the default low priority)
bssid	Mac address of the access point	mac address
scan_ssid	Enable/disbale ssid scan	0, 1, 2
key_mgmt	Type of key management	WPA-PSK, WPA_EAP, None
pairwise	Pairwise ciphers for WPA	CCMP, TKIP
group=TKIP	Group ciphers for WPA	CCMP, TKIP, WEP104, WEP40
psk	Pre-Shared Key (clear or encrypted)	string
wep_key0	WEP key (up to 4: wep_key[0123])	string
eap	Extensible Authentication Protocol	MD5, MSCHAPV2, OTP, GTC, TLS, PEAP, TTLS
identity	EAP identity string	string
password	EAP password	string
ca_cert	Pathname to CA certificate file	/full/path/to/certificate
client_cert	Pathname to client certificate	/full/path/to/certificate (PEM/DER)
private_key	Pathname to a client private key file	/full/path/to/private_key (PEM/DER/PFX)

Example of using set_network from the command line:

set_network 0 ssid "my access point"
set_network 0 id_str Home_Network
set_network 0 bssid 00:0d:0b:64:00:6c
set_network 0 scan_ssid 0
set_network 0 key_mgmt WPA-PSK
set_network 0 pairwise CCMP TKIP
set_network 0 group CCMP TKIP
set_network 0 psk "makemeveryverysecret"
set_network 0 EAP TLS
set_network 0 "[email protected]"
set_network 0 ca_cert "/etc/cert/ca.pem"
set_network 0 client_cert "/etc/cert/user.pem"
set_network 0 private_key "/etc/cert/user.prv"

Example of setting set_network keys in wpa_supplicant.conf:

network={
    ssid="my access point"
    id_str="Home_Network"
    bssid=00:0d:0b:64:00:6c
    scan_ssid=0
    key_mgmt=WPA-PSK
    pairwise=CCMP TKIP
    group=CCMP TKIP
    psk=c2277f7dd8cb0000fe000000b76cfda7102ed7eefbd29ad0000000000f5e349a
}

Thanks to Red Hat for the information.