# Macros, Tables
wlan="ath0"
wired="sis0"

# simple and insecure way to detect our accesspoints by vendor id
table <myess> const { 00:02:6f:ff:ff:ff & ff:ff:ff:00:00:00 }

# Global options
set hostap interface $wlan
set iapp interface $wired
set hostap mode radiotap
set iapp mode multicast

# Event rules
# send deauth on traffic to unknown accesspoints
hostap handle type data bssid !<myess> \
    with frame type management subtype deauth reason auth expire \
    from &bssid to &from bssid &bssid

# log unknown accesspoints with radiotap dumps
hostap handle type management subtype beacon bssid !<myess> \
    with iapp type radiotap limit 1 sec