---
name: "wpa_cli"
section: "8"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["linux", "freebsd"]
url: "https://new.carta.tech/wpa_cli/8"
---

# wpa\_cli(8)

console utility for WiFi authentication with wpa\_supplicant

## NAME

**wpa\_cli** – console utility for WiFi authentication with wpa\_supplicant

## SYNOPSIS

**wpa\_cli** \[**-p** *path\_to\_ctrl\_sockets*\] \[**-i** *ifname*\] \[**-hvB**\] \[**-a** *action\_file*\] \[**-P** *pid\_file*\] \[**-g** *global\_ctrl*\] \[**-G** *ping\_interval*\] *command* *...*

## DESCRIPTION

The **wpa\_cli** utility is a text-based frontend program for interacting with [wpa\_supplicant(8)](/wpa_supplicant/8.md). It is used to query current status, change configuration, trigger events, and request interactive user input.

The **wpa\_cli** utility can show the current authentication status, selected security mode, dot11 and dot1x MIBs, etc. In addition, **wpa\_cli** can configure EAPOL state machine parameters and trigger events such as reassociation and IEEE 802.1X logoff/logon.

The **wpa\_cli** utility provides an interface to supply authentication information such as username and password when it is not provided in the [wpa\_supplicant.conf(5)](/wpa_supplicant.conf/5.md) configuration file. This can be used, for example, to implement one-time passwords or generic token card authentication where the authentication is based on a challenge-response that uses an external device for generating the response.

The **wpa\_cli** utility supports two modes: interactive and command line. Both modes share the same command set and the main difference is in interactive mode providing access to unsolicited messages (event messages, username/password requests).

Interactive mode is started when **wpa\_cli** is executed without any parameters on the command line. Commands are then entered from the controlling terminal in response to the **wpa\_cli** prompt. In command line mode, the same commands are entered as command line arguments.

The control interface of [wpa\_supplicant(8)](/wpa_supplicant/8.md) can be configured to allow non-root user access by using the *ctrl\_interface\_group* parameter in the [wpa\_supplicant.conf(5)](/wpa_supplicant.conf/5.md) configuration file. This makes it possible to run **wpa\_cli** with a normal user account.

## AUTHENTICATION PARAMETERS

When [wpa\_supplicant(8)](/wpa_supplicant/8.md) needs authentication parameters, such as username and password, that are not present in the configuration file, it sends a request message to all attached frontend programs, e.g., **wpa\_cli** in interactive mode. The **wpa\_cli** utility shows these requests with a “CTRL-REQ-⟨*type*⟩-⟨*id*⟩:⟨*text*⟩” prefix, where ⟨*type*⟩ is IDENTITY, PASSWORD, or OTP (One-Time Password), ⟨*id*⟩ is a unique identifier for the current network, ⟨*text*⟩ is a description of the request. In the case of an OTP (One-Time Password) request, it includes the challenge from the authentication server.

A user must supply [wpa\_supplicant(8)](/wpa_supplicant/8.md) the needed parameters in response to these requests.

For example,

```
CTRL-REQ-PASSWORD-1:Password needed for SSID foobar
> password 1 mysecretpassword
Example request for generic token card challenge-response:
CTRL-REQ-OTP-2:Challenge 1235663 needed for SSID foobar
> otp 2 9876
```

## OPTIONS

These options are available:

- **-p** *path*

  Control sockets path. This should match the **ctrl\_interface** in [wpa\_supplicant.conf(5)](/wpa_supplicant.conf/5.md). The default path is */var/run/wpa\_supplicant*.

- **-i** *ifname*

  Interface to be configured. By default, the first interface found in the socket path is used.

- **-h**

  Show help.

- **-v**

  Show version information.

- **-B**

  Run the daemon in the background.

- **-a** *action\_file*

  Run in daemon mode, executing the action file based on events from [wpa\_supplicant(8)](/wpa_supplicant/8.md).

- **-P** *pid\_file*

  PID file location.

- **-g** *global\_ctrl*

  Use a global control interface to [wpa\_supplicant(8)](/wpa_supplicant/8.md) rather than the default Unix domain sockets.

- **-G** *ping\_interval*

  Wait “ping\_interval” seconds before sending each ping to [wpa\_supplicant(8)](/wpa_supplicant/8.md). See the **ping** command.

- command

  See available commands in the next section.

## COMMANDS

These commands can be supplied on the command line or at a prompt when operating interactively.

- **status**

  Report the current WPA/EAPOL/EAP status for the current interface.

- **ifname**

  Show the current interface name. The default interface is the first interface found in the socket path.

- **ping**

  Ping the [wpa\_supplicant(8)](/wpa_supplicant/8.md) utility. This command can be used to test the status of the [wpa\_supplicant(8)](/wpa_supplicant/8.md) daemon.

- **mib**

  Report MIB variables (dot1x, dot11) for the current interface.

- **help**

  Show usage help.

- **interface** \[*ifname*\]

  Show available interfaces and/or set the current interface when multiple interfaces are available.

- **level** *debug\_level*

  Change the debugging level in [wpa\_supplicant(8)](/wpa_supplicant/8.md). Larger numbers generate more messages.

- **license**

  Display the full license for **wpa\_cli**.

- **logoff**

  Send the IEEE 802.1X EAPOL state machine into the “logoff” state.

- **logon**

  Send the IEEE 802.1X EAPOL state machine into the “logon” state.

- **set** \[*settings*\]

  Set variables. When no arguments are supplied, the known variables and their settings are displayed.

- **pmksa**

  Show the contents of the PMKSA cache.

- **reassociate**

  Force a reassociation to the current access point.

- **reconfigure**

  Force [wpa\_supplicant(8)](/wpa_supplicant/8.md) to re-read its configuration file.

- **preauthenticate** *BSSID*

  Force preauthentication of the specified *BSSID*.

- **identity** *network\_id* *identity*

  Configure an identity for an SSID.

- **password** *network\_id* *password*

  Configure a password for an SSID.

- **new\_password** *network\_id* *password*

  Change the password for an SSID.

- **PIN** *network\_id* *pin*

  Configure a PIN for an SSID.

- **passphrase** *network\_id* *passphrase*

  Configure a private key passphrase for an SSID.

- **bssid** *network\_id* *bssid*

  Set a preferred BSSID for an SSID

- **blacklist** \[*bssid* \| *clear*\]

  Add a BSSID to the blacklist. When invoked without any extra arguments, display the blacklist. Specifying *clear* causes **wpa\_cli** to clear the blacklist.

- **list\_networks**

  List configured networks.

- **select\_network** *network\_id*

  Select a network and disable others.

- **enable\_network** *network\_id*

  Enable a network.

- **disable\_network** *network\_id*

  Disable a network.

- **add\_network**

  Add a network.

- **remove\_network** *network\_id*

  Remove a network.

- **set\_network** \[*network\_id* *variable* *value*\]

  Set network variables. Shows a list of variables when run without arguments.

- **get\_network** *network\_id* *variable*

  Get network variables.

- **disconnect**

  Disconnect and wait for reassociate/reconnect command before connecting.

- **reconnect**

  Similar to **reassociate**, but only takes effect if already disconnected.

- **scan**

  Request new BSS scan.

- **scan\_results**

  Get the latest BSS scan results. This command can be invoked after running a BSS scan with **scan**.

- **bss** \[*idx* \| *bssid*\]

  Get a detailed BSS scan result for the network identified by “bssid” or “idx”.

- **otp** *network\_id* *password*

  Configure a one-time password for an SSID.

- **terminate**

  Force [wpa\_supplicant(8)](/wpa_supplicant/8.md) to terminate.

- **interface\_add** *ifname* \[*confname* *driver* *ctrl\_interface* *driver\_param* *bridge\_name*\]

  Add a new interface with the given parameters.

- **interface\_remove** *ifname*

  Remove the interface.

- **interface\_list**

  List available interfaces.

- **quit**

  Exit **wpa\_cli**.

## SEE ALSO

[wpa\_supplicant.conf(5)](/wpa_supplicant.conf/5.md), [wpa\_supplicant(8)](/wpa_supplicant/8.md)

## HISTORY

The **wpa\_cli** utility first appeared in FreeBSD 6.0.

## AUTHORS

The **wpa\_cli** utility was written by Jouni Malinen ⟨*j@w1.fi*⟩. This manual page is derived from the *README* and *wpa\_cli.c* files included in the **wpa\_supplicant** distribution.