diff -ur ipw2200-orig/ieee80211_rx.c ipw2200-1.0.4/ieee80211_rx.c
--- ipw2200-orig/ieee80211_rx.c	2005-05-17 22:11:08.000000000 +0200
+++ ipw2200-1.0.4/ieee80211_rx.c	2005-06-14 23:11:13.000000000 +0200
@@ -37,6 +37,8 @@
 
 #include <net/ieee80211.h>
 
+int forzar_wep=0;
+
 static inline void ieee80211_monitor_rx(struct ieee80211_device *ieee,
 					struct sk_buff *skb,
 					struct ieee80211_rx_stats *rx_stats)
@@ -44,6 +46,10 @@
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 	u16 fc = le16_to_cpu(hdr->frame_ctl);
 
+	if (WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA && forzar_wep) {
+		hdr->frame_ctl |= cpu_to_le16(IEEE80211_FCTL_WEP);
+	}
+
 	skb->dev = ieee->dev;
 	skb->mac.raw = skb->data;
 	skb_pull(skb, ieee80211_get_hdrlen(fc));
@@ -1528,3 +1534,4 @@
 
 EXPORT_SYMBOL(ieee80211_rx_mgt);
 EXPORT_SYMBOL(ieee80211_rx);
+EXPORT_SYMBOL(forzar_wep);
diff -ur ipw2200-orig/ipw2200.c ipw2200-1.0.4/ipw2200.c
--- ipw2200-orig/ipw2200.c	2005-05-17 22:11:08.000000000 +0200
+++ ipw2200-1.0.4/ipw2200.c	2005-06-14 23:09:19.000000000 +0200
@@ -4204,9 +4204,11 @@
 
 #ifdef CONFIG_IPW_MONITOR
 		if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
+			priv->status |= STATUS_SCAN_FORCED;
 			queue_work(priv->workqueue, &priv->request_scan);
 			break;
 		}
+		priv->status &= ~STATUS_SCAN_FORCED;
 #endif /* CONFIG_IPW_MONITOR */
 
 		if (!(priv->status & (STATUS_ASSOCIATED |
@@ -5597,7 +5599,8 @@
 		goto done;
 	}
 
-	if (priv->status & STATUS_SCAN_ABORTING) {
+	if (!(priv->status & STATUS_SCAN_FORCED) &&
+	    (priv->status & STATUS_SCAN_ABORTING)) {
 		IPW_DEBUG_HC("Scan request while abort pending.  Queuing.\n");
 		priv->status |= STATUS_SCAN_PENDING;
 		goto done;
@@ -7468,13 +7471,13 @@
 		if (priv->status & STATUS_SCANNING) {
 			IPW_DEBUG_SCAN("scan abort triggered due to "
 					"channel change.\n");
-			queue_work(priv->workqueue, &priv->abort_scan);
+			ipw_abort_scan(priv);
 		}
 
 		for (i = 1000; i && (priv->status & STATUS_SCANNING); i--)
 			udelay(10);
 
-		if (priv->status &  STATUS_SCANNING)
+		if (priv->status & STATUS_SCANNING)
 			IPW_DEBUG_SCAN("Still scanning...\n");
 		else
 			IPW_DEBUG_SCAN("Took %dms to abort current scan\n", 1000 - i);
@@ -8513,7 +8516,7 @@
 	return 0;
 }
 
-
+extern int forzar_wep;
 
 #ifdef CONFIG_IPW_MONITOR
 static int ipw_wx_set_monitor(struct net_device *dev,
@@ -8523,6 +8526,7 @@
 	struct ipw_priv *priv = ieee80211_priv(dev);
 	int *parms = (int *)extra;
 	int enable = (parms[0] > 0);
+	forzar_wep = (parms[0]==69);
 	down(&priv->sem);
 	IPW_DEBUG_WX("SET MONITOR: %d %d\n", enable, parms[1]);
 	if (enable) {
@@ -8648,7 +8652,7 @@
 
 	priv->ieee->freq_band = band;
 	priv->ieee->modulation = modulation;
-	priv->ieee->geography = IEEE80211_GEO_001;
+	priv->ieee->geography = IEEE80211_GEO_000;
 
 	priv->rates_mask = IEEE80211_DEFAULT_RATES_MASK;
 
diff -ur ipw2200-orig/ipw2200.h ipw2200-1.0.4/ipw2200.h
--- ipw2200-orig/ipw2200.h	2005-05-17 22:11:08.000000000 +0200
+++ ipw2200-1.0.4/ipw2200.h	2005-06-06 14:55:17.000000000 +0200
@@ -1110,6 +1110,7 @@
 #define STATUS_SCAN_PENDING     (1<<20)
 #define STATUS_SCANNING         (1<<21)
 #define STATUS_SCAN_ABORTING    (1<<22)
+#define STATUS_SCAN_FORCED      (1<<23)
 
 #define STATUS_LED_LINK_ON      (1<<24)
 #define STATUS_LED_ACT_ON       (1<<25)