utility listens for events generated by an
wireless network driver and relays them to
for possible processing. The three event types that can occur are media connect and disconnect events, such as when a wireless interface joins or leaves a network, and media-specific events. In particular,
drivers that support WPA2 will generate media-specific events containing PMKID candidate information which
needs in order to properly associate with WPA2-capable access points.
The ndis_events daemon works by listening for interface information events via a routing socket. When it detects an event that was generated by an ndis(4) interface, it transmits it via UDP packet on the loopback interface, where wpa_supplicant(8) is presumably listening. The standard wpa_supplicant(8) distribution includes its own version of this utility for use with Windows®. The FreeBSD version performs the same functions as the Windows® one, except that it uses an ioctl(4) and routing socket interface instead of WMI.
Note that a single instance of ndis_events is sufficient to scan for events for any number of ndis(4) interfaces in a system.