diff --git a/ac.project b/ac.project
index 5768a631..2cf3d6ee 100644
--- a/ac.project
+++ b/ac.project
@@ -23,6 +23,7 @@
       <File Name="src/ac/socklist.h"/>
       <File Name="src/ac/discovery_cache.c"/>
       <File Name="src/ac/discovery_cache.h"/>
+      <File Name="src/ac/shell.c"/>
     </VirtualDirectory>
   </VirtualDirectory>
   <Description/>
diff --git a/actube.workspace b/actube.workspace
index 07586c53..b21adfd1 100644
--- a/actube.workspace
+++ b/actube.workspace
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <CodeLite_Workspace Name="actube" Database="">
-  <Project Name="ac" Path="ac.project" Active="No"/>
-  <Project Name="wtp" Path="wtp.project" Active="Yes"/>
+  <Project Name="ac" Path="ac.project" Active="Yes"/>
+  <Project Name="wtp" Path="wtp.project" Active="No"/>
   <Project Name="mod_cipwap" Path="mod_cipwap.project" Active="No"/>
   <Project Name="mod_capwap" Path="mod_capwap.project" Active="No"/>
   <Project Name="mod_cisco" Path="mod_cisco.project" Active="No"/>
diff --git a/src/ac/Makefile b/src/ac/Makefile
index 93844e4f..d0d51c2b 100644
--- a/src/ac/Makefile
+++ b/src/ac/Makefile
@@ -58,6 +58,7 @@ AC_OBJS = \
 	db.o \
 	ac_global.o \
 	discovery_cache.o\
+	shell.o\
 	${AC_MODULES}
 
 
diff --git a/src/ac/ac_main.c b/src/ac/ac_main.c
index 03c47f87..2b9b4126 100644
--- a/src/ac/ac_main.c
+++ b/src/ac/ac_main.c
@@ -230,6 +230,7 @@ int main (int argc, char *argv[])
 	FILE * file;
 	mavl_t types_tree, global_cfg;
 	const cw_Type_t **ti;
+	
 
 	/* parse arguments */
 	parse_args (argc, argv, &bootcfg);
@@ -278,7 +279,10 @@ exit(0);
 	if (!read_config ("ac.conf"))
 		return 1;
 		
-		
+start_shell();
+
+
+
 	/* Show debug options if there are any set */
 	if (cw_dbg_opt_level)
 		cw_log (LOG_INFO, "Debug Options: %08X", cw_dbg_opt_level);
diff --git a/src/ac/shell.c b/src/ac/shell.c
index e69de29b..c0b1668b 100644
--- a/src/ac/shell.c
+++ b/src/ac/shell.c
@@ -0,0 +1,110 @@
+
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include "cw/sock.h"
+#include "cw/log.h"
+#include "cw/dbg.h"
+
+
+void execute_cmd(const char *str)
+{
+	char cmd[1024];
+	char args[1024];
+	
+	sscanf(str,"%s%s",cmd,args);
+	printf("CMD: %s, ARGS: %s\n",cmd,args);
+	
+
+
+}
+
+
+void shell_loop(FILE *file)
+{
+	int c;
+/*	setvbuf(file,NULL,_IONBF,0);
+	fflush(file);
+*/
+
+	char str[2048];
+
+
+	do {
+		fprintf(file,"actube[%d]:>",fileno(file));
+		fflush(file);
+		
+		fgets(str,sizeof(str),file);
+		execute_cmd(str);
+
+	}while (c!=EOF);
+	
+}
+
+
+void * run_shell(void * arg)
+{
+	struct sockaddr_storage server, client;
+	socklen_t client_size;
+	char sockstr[SOCK_ADDR_BUFSIZE];
+	
+	int rc;
+	const char * addr = "127.0.0.1:5000";
+	int sockfd, clientsock;
+	int yes;
+	
+	rc = sock_strtoaddr(addr,(struct sockaddr*)&server);
+	if (! rc ){
+		cw_log(LOG_ERR,"Can't parse address '%s', %s",addr,strerror(errno));
+	}
+
+	sockfd = socket(((struct sockaddr*)&server)->sa_family,SOCK_STREAM,0);
+	
+	yes = 1;
+	/* reuse address */
+	setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes));
+	
+
+	/* bind address */
+	rc =  bind(sockfd,(struct sockaddr*)&server,sizeof(server));
+	if (rc ){
+		cw_log(LOG_ERR,"Can't bind socket address '%s', %s",addr,strerror(errno));
+	}
+	
+	rc = listen(sockfd,5);
+	if (rc ){
+		cw_log(LOG_ERR,"Can't listen on address '%s', %s",addr,strerror(errno));
+	}
+	
+
+	client_size = sizeof(client);
+	clientsock = accept(sockfd,(struct sockaddr*)&client,&client_size);
+	
+	if (clientsock>0){
+		sock_addr2str_p(&client,sockstr);
+		cw_dbg(DBG_INFO, "Acceptiong session from %s",sockstr);
+		shell_loop(fdopen(clientsock,"a+"));
+		close(clientsock);
+	}
+	
+	
+	
+	printf("Accepting %i, %s",rc,strerror(errno));
+	
+	
+	
+
+	return NULL;
+}
+
+
+void start_shell()
+{
+	pthread_t thread;
+	pthread_create(&thread, NULL, run_shell,
+                       NULL);
+}
\ No newline at end of file
diff --git a/src/mod/cisco/capwap_cisco.h b/src/mod/cisco/capwap_cisco.h
index bd911441..0b88f345 100644
--- a/src/mod/cisco/capwap_cisco.h
+++ b/src/mod/cisco/capwap_cisco.h
@@ -98,7 +98,7 @@
 #define CISCO_ELEM_AP_BACKUP_SOFTWARE_VERSION	183
 #define CW_CISCO_BOARD_DATA_OPTIONS		207
 #define CISCO_ELEM_MWAR_TYPE			208
-#define CW_CISCO_80211_ASSOC_LIMIT		213
+#define CISCO_ELEM_80211_ASSOC_LIMIT		213
 #define CW_CISCO_TLV_PAYLOAD			215
 #define CISCO_ELEM_AP_LOG_FACILITY		224
 
diff --git a/src/mod/cisco/cisco_actions_ac.c b/src/mod/cisco/cisco_actions_ac.c
index 4ba64b64..f7dd1aea 100644
--- a/src/mod/cisco/cisco_actions_ac.c
+++ b/src/mod/cisco/cisco_actions_ac.c
@@ -182,7 +182,7 @@ static cw_KTVStruct_t cisco_ap_regulatory_domain5[]={
 	{NULL,NULL,0,0}
 };
 
-static cw_KTVStruct_t cisco_mac_operation[]={
+static cw_KTVStruct_t cisco_mac_operation73[]={
 	{CW_TYPE_BYTE,"reserved",1,-1},
 	{CW_TYPE_WORD,"rts-threshold",2,-1},
 	{CW_TYPE_BYTE,"short-retry",1,-1},
@@ -193,6 +193,18 @@ static cw_KTVStruct_t cisco_mac_operation[]={
 	{NULL,NULL,0,0}
 };
 
+static cw_KTVStruct_t cisco_mac_operation75[]={
+	{CW_TYPE_WORD,"reserved",2,-1},
+	{CW_TYPE_WORD,"rts-threshold",2,-1},
+	{CW_TYPE_BYTE,"short-retry",1,-1},
+	{CW_TYPE_BYTE,"long-retry",1,-1},
+	{CW_TYPE_WORD,"fragmentation-threshold",2,-1},
+	{CW_TYPE_DWORD,"tx-msdu-lifetime",4,-1},
+	{CW_TYPE_DWORD,"rx-msdu-lifetime",4,-1},
+	{NULL,NULL,0,0}
+};
+
+
 static cw_KTVStruct_t cisco_ap_power_injector_config[]={
 	{CW_TYPE_BYTE,"state",1,-1},
 	{CW_TYPE_BYTE,"selection",1,-1},
@@ -546,6 +558,19 @@ static cw_KTVStruct_t cisco_rad_extended_config[]={
 	{NULL,NULL,0,0}
 };
 
+
+static cw_KTVStruct_t cisco_80211_assoc_limit[]={
+	{CW_TYPE_BOOL, "enable",1,-1},
+	{CW_TYPE_BYTE, "limit",1,-1},
+	{CW_TYPE_WORD, "interval",1,-1},
+	{NULL,NULL,0,0}
+};
+
+static cw_KTVStruct_t cisco_dot11r_wlc_mac_and_ip[]={
+	{CW_TYPE_IPADDRESS, "ip-address",4,-1},
+	{CW_TYPE_BSTR16, ",ac-address",6,-1},
+	{NULL,NULL,0,0}
+};
 /*
 
 static int cisco_data(struct cw_ElemHandler *eh, 
@@ -992,7 +1017,7 @@ static struct cw_ElemHandler handlers73[] = {
 		CISCO_ELEM_MAC_OPERATION,		/* Element ID */
 		CW_VENDOR_ID_CISCO,0,			/* Vendor / Proto */
 		16,16,					/* min/max length */
-		cisco_mac_operation,			/* type */
+		cisco_mac_operation73,			/* type */
 		"cisco/mac-operation",			/* Key */
 		cw_in_radio_generic_struct,		/* get */
 		cw_out_radio_generic_struct		/* put */
@@ -1273,6 +1298,41 @@ static struct cw_ElemHandler handlers73[] = {
 	}
 	,
 
+	{
+		"8021.11 Assoc Limit (Cisco)",			/* name */
+		CISCO_ELEM_80211_ASSOC_LIMIT,			/* Element ID */
+		CW_VENDOR_ID_CISCO, 0,						/* Vendor / Proto */
+		4, 4,						/* min/max length */
+		cisco_80211_assoc_limit,			/* type */
+		"cisco-8011-assoc-limit",			/* Key */
+		cw_in_generic_struct,				/* get */
+		cw_out_generic_struct				/* put */
+	}
+	,
+
+	{
+		"CISCO Sig Toggle",				/* name */
+		CISCO_ELEM_SIG_TOGGLE,				/* Element ID */
+		CW_VENDOR_ID_CISCO, 0,				/* Vendor / Proto */
+		1, 1,						/* min/max length */
+		CW_TYPE_BOOL,					/* type */
+		"cisco/sig-toogle",				/* Key */
+		cw_in_generic,					/* get */
+		cw_out_generic					/* put */
+	}
+	,
+
+	{
+		"Dot11r WLC Mac And IP (Cisco)",		/* name */
+		CISCO_LWELEM_DOT11R_WLC_MAC_AND_IP,		/* Element ID */
+		0, 0,						/* Vendor / Proto */
+		4, 4,						/* min/max length */
+		cisco_dot11r_wlc_mac_and_ip,			/* type */
+		"cisco/dot11r-wlc-mac-and-ip",			/* Key */
+		cw_in_generic_struct,				/* get */
+		cw_out_generic_struct				/* put */
+	}
+	,
 	{0,0,0,0,0,0,0,0}
 
 };
@@ -1424,6 +1484,9 @@ static struct cw_ElemDef configuration_update_request_elements[] ={
 	{0, CW_VENDOR_ID_CISCO,	CISCO_ELEM_STATISTICS_TIMER,		0, 0},
 	{0, CW_VENDOR_ID_CISCO,	CISCO_ELEM_AC_NAME_WITH_INDEX,		0, 0},
 	{0, CW_VENDOR_ID_CISCO,	CISCO_ELEM_AP_VENUE_SETTINGS,		0, 0},
+	{0, CW_VENDOR_ID_CISCO,	CISCO_ELEM_80211_ASSOC_LIMIT,		0, 0},
+	{0, CW_VENDOR_ID_CISCO,	CISCO_ELEM_SIG_TOGGLE,			0, 0},
+	{0, CW_VENDOR_ID_CISCO,	CISCO_ELEM_MAC_OPERATION,		0, 0},
 
 	{0, CW_VENDOR_ID_CISCO,	CISCO_ELEM_ADD_WLAN,			0, CW_IGNORE},
 
@@ -1577,6 +1640,17 @@ static struct cw_ElemHandler handlers75[] = {
 		cw_out_radio_generic_struct		/* put */
 	}
 	,
+	{ 
+		"Mac Operation (Version >= 7.5",	/* name */
+		CISCO_ELEM_MAC_OPERATION,		/* Element ID */
+		CW_VENDOR_ID_CISCO,0,			/* Vendor / Proto */
+		17,17,					/* min/max length */
+		cisco_mac_operation75,			/* type */
+		"cisco/mac-operation",			/* Key */
+		cw_in_radio_generic_struct,		/* get */
+		cw_out_radio_generic_struct		/* put */
+	},
+
 	{0,0,0,0,0,0,0,0}
 };
 
diff --git a/src/mod/cisco/lwapp_cisco.h b/src/mod/cisco/lwapp_cisco.h
index c71d06f3..149c40e9 100644
--- a/src/mod/cisco/lwapp_cisco.h
+++ b/src/mod/cisco/lwapp_cisco.h
@@ -59,7 +59,7 @@
 #define CISCO_LWELEM_SSC_HASH			132
 
 #define CISCO_LWELEM_MWAR_HASH_VALUE		134
-#define LW_CISCO_DOT11R_WLC_MAC_AND_IP		135
+#define CISCO_LWELEM_DOT11R_WLC_MAC_AND_IP	135
 
 #define CISCO_LWELEM_HARDWARE_INFO		139
 
diff --git a/src/wtp/cisco.ktv b/src/wtp/cisco.ktv
index f91fb9ed..71ad7708 100644
--- a/src/wtp/cisco.ktv
+++ b/src/wtp/cisco.ktv
@@ -7,25 +7,28 @@ ac-descriptor/r-mac-field :Byte: 1
 ac-descriptor/reserved1 :Byte: 0
 ac-descriptor/security :Byte: 2
 ac-descriptor/software/vendor :Dword: 4232704
-ac-descriptor/software/version :Bstr16: .x07036500
+ac-descriptor/software/version :Bstr16: .x07056600
 ac-descriptor/station-limit :Word: 1000
 ac-descriptor/stations :Word: 0
-ac-name :Bstr16: CiscoAC73
+ac-name :Bstr16: CisAC175
 ac-name-with-index.0 :Bstr16: tabbe88
 ac-name-with-index.1 :Bstr16: nudelnudel
 ac-name-with-index.2 :Bstr16: nadelnalde
 ac-name-with-priority/X1 :Byte: 3
 ac-name-with-priority/ac2 :Byte: 5
-capwap-control-ip-address/address.0 :IPAddress: 192.168.0.173
-capwap-control-ip-address/address.1 :IPAddress: d96c:4c0a:da6c:4c0a:db6c:4c0a:dc6c:4c0a
+capwap-control-ip-address/address.0 :IPAddress: 192.168.0.175
+capwap-control-ip-address/address.1 :IPAddress: 192.168.0.175
 capwap-control-ip-address/address.2 :IPAddress: 192.168.0.173
 capwap-control-ip-address/wtps.0 :Word: 0
-capwap-control-ip-address/wtps.1 :Word: 10
+capwap-control-ip-address/wtps.1 :Word: 1
 capwap-control-ip-address/wtps.2 :Word: 1
 capwap-local-ip-address :IPAddress: 192.168.56.1
 capwap-timers/echo-interval :Byte: 30
 capwap-timers/max-discovery-interval :Byte: 10
 capwap-timers/min-discovery-interval :Byte: 0
+cisco-8011-assoc-limit/enable :Bool: false
+cisco-8011-assoc-limit/interval :Word: 500
+cisco-8011-assoc-limit/limit :Byte: 25
 cisco/ac-ip-addr-with-index.0 :IPAddress: 1.1.1.1
 cisco/ac-ip-addr-with-index.1 :IPAddress: 9.9.9.9
 cisco/ac-ip-addr-with-index.2 :IPAddress: 3.3.3.3
@@ -44,7 +47,7 @@ cisco/ap-model/model :Str: AIR-LAP1142N-E-K9
 cisco/ap-power-injector-config/selection :Byte: 0
 cisco/ap-power-injector-config/sitch-mac-address :Bstr16: .x000000000000
 cisco/ap-power-injector-config/state :Byte: 17
-cisco/ap-pre-std-switch-config :Byte: 0
+cisco/ap-pre-std-switch-config :Byte: 1
 cisco/ap-regulatory-domain.0/band-id :Byte: 0
 cisco/ap-regulatory-domain.0/code0 :Byte: 0
 cisco/ap-regulatory-domain.0/code1 :Byte: 1
@@ -58,7 +61,7 @@ cisco/ap-regulatory-domain.1/slot :Byte: 1
 cisco/ap-sub-mode :Byte: 0
 cisco/ap-telnet-ssh/ssh :Bool: false
 cisco/ap-telnet-ssh/telnet :Bool: false
-cisco/ap-timesync/timestamp :Dword: 1524833707
+cisco/ap-timesync/timestamp :Dword: 1525248241
 cisco/ap-timesync/type :Byte: 0
 cisco/ap-username-and-password/802.1x-credentials/option :Word: 2
 cisco/ap-username-and-password/802.1x-credentials/password :Str: 
@@ -74,7 +77,7 @@ cisco/ap-venue-settings/type :Byte: 1
 cisco/board-data-options :Dword: 16777217
 cisco/cisco-discovery-protocol/data :Word: 0
 cisco/cisco-discovery-protocol/enabled :Bool: false
-cisco/hash/hash :Bstr16: 25f312452fcb0a908007304aa201d175d0516d7a
+cisco/hash/hash :Bstr16: 88ba29f4725fcbc8fd02843186b94692f107ecb0
 cisco/hash/validate :Bool: true
 cisco/loghost-config/last-joined-ap :Str: 
 cisco/loghost-config/loghost.0 :IPAddress: 7.7.1.3
@@ -86,14 +89,15 @@ cisco/lw_path_mtu/max :Word: 1485
 cisco/mwar-addr/address :IPAddress: 192.168.0.180
 cisco/mwar-addr/mwar-type :Byte: 1
 cisco/mwar-addr/unknown :Word: 0
-cisco/mwar-hash-value :Bstr16: 25f312452fcb0a908007304aa201d175d0516d7a
-cisco/mwar-type :Byte: 0
+cisco/mwar-hash-value :Bstr16: 88ba29f4725fcbc8fd02843186b94692f107ecb0
+cisco/mwar-type :Byte: 1
 cisco/rouge-and-mss/enable :Bool: true
 cisco/rouge-and-mss/mss :Word: 666
 cisco/rouge-and-mss/roge-detection :Bool: true
 cisco/rouge-and-mss/tcp-adjust-mss :Word: 1234
 cisco/rouge-detection/rest :Bstr16: .x000aff800000
 cisco/rouge-detection/rouge-detection :Bool: false
+cisco/sig-toogle :Bool: true
 cisco/ssl-certfile :Str: ../../ssl/certs/wtpc.crt
 cisco/ssl-cipher :Str: ALL
 cisco/ssl-keyfile :Str: ../../ssl/certs/wtpc.key
@@ -122,9 +126,10 @@ radio.0/cisco-multi-domain-capability/max-tx-power-level :Word: 65535
 radio.0/cisco-multi-domain-capability/number-of-channels :Word: 13
 radio.0/cisco-multi-domain-capability/reserved :Byte: 1
 radio.0/cisco/air-space-capability :Byte: 0
-radio.0/cisco/mac-operation/fragmentation-threshold :Word: 2346
+radio.0/cisco/mac-operation/byte75 :Byte: 0
+radio.0/cisco/mac-operation/fragmentation-threshold :Word: 1234
 radio.0/cisco/mac-operation/long-retry :Byte: 4
-radio.0/cisco/mac-operation/reserved :Byte: 1
+radio.0/cisco/mac-operation/reserved :Word: 1
 radio.0/cisco/mac-operation/rts-threshold :Word: 2347
 radio.0/cisco/mac-operation/rx-msdu-lifetime :Dword: 512
 radio.0/cisco/mac-operation/short-retry :Byte: 7
@@ -176,9 +181,10 @@ radio.1/cisco-multi-domain-capability/max-tx-power-level :Word: 65535
 radio.1/cisco-multi-domain-capability/number-of-channels :Word: 16
 radio.1/cisco-multi-domain-capability/reserved :Byte: 1
 radio.1/cisco/air-space-capability :Byte: 0
-radio.1/cisco/mac-operation/fragmentation-threshold :Word: 2346
+radio.1/cisco/mac-operation/byte75 :Byte: 0
+radio.1/cisco/mac-operation/fragmentation-threshold :Word: 1233
 radio.1/cisco/mac-operation/long-retry :Byte: 4
-radio.1/cisco/mac-operation/reserved :Byte: 1
+radio.1/cisco/mac-operation/reserved :Word: 257
 radio.1/cisco/mac-operation/rts-threshold :Word: 2347
 radio.1/cisco/mac-operation/rx-msdu-lifetime :Dword: 512
 radio.1/cisco/mac-operation/short-retry :Byte: 7
@@ -189,7 +195,7 @@ radio.1/cisco/multi-domain-capability/number-of-channels :Word: 4
 radio.1/cisco/multi-domain-capability/reserved :Byte: 1
 radio.1/cisco/tx-power/current-tx-power :Word: 0
 radio.1/cisco/tx-power/reserved :Byte: 1
-radio.1/cisco/wtp-radio-config/beacon-period :Word: 100
+radio.1/cisco/wtp-radio-config/beacon-period :Word: 700
 radio.1/cisco/wtp-radio-config/bss-id :Bstr16: .x04fe7f499b90
 radio.1/cisco/wtp-radio-config/cfg-period :Byte: 4
 radio.1/cisco/wtp-radio-config/cfg-type :Byte: 1
@@ -197,7 +203,7 @@ radio.1/cisco/wtp-radio-config/cfp-maximum-duration :Word: 60
 radio.1/cisco/wtp-radio-config/country-str1 :Str: DE
 radio.1/cisco/wtp-radio-config/country-str2 :Str: DE 
 radio.1/cisco/wtp-radio-config/gpr-period :Byte: 10
-radio.1/cisco/wtp-radio-config/max-stations :Byte: 200
+radio.1/cisco/wtp-radio-config/max-stations :Byte: 13
 radio.1/cisco/wtp-radio-config/occupancy-limit :Word: 100
 radio.1/cisco/wtp-radio-config/reg :Dword: 65536
 radio.1/cisco/wtp-radio-config/unknown75 :Byte: 1
@@ -213,12 +219,18 @@ radio.1/wlan.0/encryption-policy :Dword: 16777216
 radio.1/wlan.0/max-stations :Byte: 200
 radio.1/wlan.0/radio-id :Byte: 1
 radio.1/wlan.0/session-timout :Word: 1800
-radio.1/wlan.0/ssid :Str: Schlosspark
+radio.1/wlan.0/ssid :Str: Superlan
 radio.1/wlan.0/ssid-a :Str: Schlosspark
 radio.1/wlan.0/wep-key :Bstr16: .xaa0c0a02000000000000000000
 radio.1/wlan.0/wlan-capability :Word: 1
 radio.1/wlan.0/wlan-id :Byte: 0
 radio.1/wtp-radio-information :Dword: 2
+radio.2/cisco/rad-extended-config/beacon-interval :Word: 48128
+radio.2/cisco/rad-extended-config/beacon-range :Word: 0
+radio.2/cisco/rad-extended-config/c-ccat :Word: 1
+radio.2/cisco/rad-extended-config/multicast-buffer :Word: 0
+radio.2/cisco/rad-extended-config/multicast-data-range :Word: 0
+radio.2/cisco/rad-extended-config/rx-sensop-threshold :Word: 0
 radio.3/cisco/rad-extended-config/beacon-interval :Word: 59392
 radio.3/cisco/rad-extended-config/beacon-range :Word: 0
 radio.3/cisco/rad-extended-config/c-ccat :Word: 1
@@ -257,7 +269,7 @@ wtp-descriptor/hardware/version :Bstr16: .x01000000
 wtp-descriptor/max-radios :Byte: 2
 wtp-descriptor/radios-in-use :Byte: 2
 wtp-descriptor/software/vendor :Dword: 4232704
-wtp-descriptor/software/version :Bstr16: .x07036500
+wtp-descriptor/software/version :Bstr16: .x07056600
 wtp-fallback :Byte: 1
 wtp-frame-tunnel-mode :Byte: 4
 wtp-mac-type :Byte: 1