diff --git a/src/core/cntlr_cmdu_generator.c b/src/core/cntlr_cmdu_generator.c
index 39949f531372c45773650b9d6ba1bf25bacb6d50..d32f7600fa910d0f4a3cd0157659edaf5fdd489c 100644
--- a/src/core/cntlr_cmdu_generator.c
+++ b/src/core/cntlr_cmdu_generator.c
@@ -402,6 +402,29 @@ fail_cmdu:
 	return NULL;
 }
 
+struct cmdu_cstruct *cntlr_gen_bk_caps_query(struct controller *c,
+		uint8_t *origin, char *intf_name)
+{
+	struct cmdu_cstruct *cmdu;
+
+	cmdu = calloc(1, sizeof(struct cmdu_cstruct));
+	if (!cmdu) {
+		fprintf(stderr, "failed to malloc cmdu\n");
+		return NULL;
+	}
+
+	cmdu_defaults(c, cmdu, origin, intf_name,
+			CMDU_BACKHAUL_STA_CAPABILITY_QUERY);
+
+	cmdu->num_tlvs = 0;
+
+	return cmdu;
+
+fail_cmdu:
+	map_free_cmdu(cmdu);
+	return NULL;
+}
+
 struct cmdu_cstruct *cntlr_gen_ap_autoconfig_search(struct controller *c,
 		char *intf_name, uint8_t profile, uint8_t band)
 {
diff --git a/src/core/cntlr_map_debug.c b/src/core/cntlr_map_debug.c
index f604204de9c9a334072bd67cb93af031974ceae7..91bfa231fcc3b03d74ade790f49b9baa2b293b81 100644
--- a/src/core/cntlr_map_debug.c
+++ b/src/core/cntlr_map_debug.c
@@ -924,7 +924,7 @@ int debug_channel_scan_report(void *cntlr, struct cmdu_cstruct *cmdu)
 	uint8_t *tlv = NULL;
 
 	for (i = 0; i < cmdu->num_tlvs; i++) {
-		tlv = (uint16_t *) cmdu->tlvs[i];
+		tlv = (uint8_t *) cmdu->tlvs[i];
 		trace("\nCMDU type: %s\n", map_stringify_tlv_type(*tlv));
 		switch (*tlv) {
 		case MAP_TLV_TIMESTAMP:
@@ -1043,6 +1043,19 @@ int debug_tunneled_message(void *cntlr, struct cmdu_cstruct *cmdu)
 int debug_backhaul_sta_caps_report(void *cntlr, struct cmdu_cstruct *cmdu)
 {
 	trace("%s: --->\n", __func__);
+	uint8_t *tlv;
+	int i = 0;
+
+	for (i = 0; i < cmdu->num_tlvs; i++) {
+		tlv = (uint8_t *) cmdu->tlvs[i];
+		trace("\nCMDU type: %s\n", map_stringify_tlv_type(*tlv));
+		struct tlv_backhaul_sta_radio_cap *p =
+				(struct tlv_backhaul_sta_radio_cap *)tlv;
+		trace("\tradio_id: " MACFMT "\n", MAC2STR(p->radio_id));
+		trace("\tmac_include: %d\n", p->mac_include);
+		if (p->mac_include)
+			trace("\tmac: " MACFMT "\n", MAC2STR(p->mac));
+	}
 	return 0;
 }
 
diff --git a/src/core/cntlr_ubus.c b/src/core/cntlr_ubus.c
index 506654425af6a7172e429f2ade034b98f9864b19..862e0f92f4b7a447308308ec3511642db9414d50 100644
--- a/src/core/cntlr_ubus.c
+++ b/src/core/cntlr_ubus.c
@@ -236,6 +236,15 @@ static const struct blobmsg_policy sta_metric_query_params[__STA_METRIC_QUERY_MA
 	[STA_METRIC_QUERY_STA] = { .name = "sta", .type = BLOBMSG_TYPE_STRING },
 };
 
+enum {
+	BK_CAPS_POLICY_AGENT,
+	__BK_CAPS_POLICY_MAX,
+};
+
+static const struct blobmsg_policy bk_caps_policy_params[__BK_CAPS_POLICY_MAX] = {
+	[BK_CAPS_POLICY_AGENT] = { .name = "agent", .type = BLOBMSG_TYPE_STRING },
+};
+
 void send_cmdu_cb(struct ubus_request *req,
 				int type, struct blob_attr *msg)
 {
@@ -1588,6 +1597,8 @@ static int cntlr_scan(struct ubus_context *ctx, struct ubus_object *obj,
 			trace(" %d", channel[i][j]);
 			j++;
 		}
+		if (j == 0) // all_ch_scan
+			trace(" all");
 		trace("\n");
 		i++; j = 0;
 	}
@@ -1696,6 +1707,42 @@ static int cntlr_sta_metric_query(struct ubus_context *ctx,
 	return UBUS_STATUS_OK;
 }
 
+static int cntlr_bk_caps(struct ubus_context *ctx, struct ubus_object *obj,
+			struct ubus_request_data *req, const char *method,
+			struct blob_attr *msg)
+{
+	trace("%s:--->\n", __func__);
+	struct blob_attr *tb[__BK_CAPS_POLICY_MAX];
+	struct controller *c = container_of(obj, struct controller, obj);
+	char agent[18] = { 0 };
+	uint8_t agent_mac[6] = { 0 };
+	struct cmdu_cstruct *cmdu_data;
+
+	blobmsg_parse(bk_caps_policy_params, __BK_CAPS_POLICY_MAX, tb,
+			blob_data(msg), blob_len(msg));
+
+	// are the ubus method parameter empty?
+	if (!tb[BK_CAPS_POLICY_AGENT]) {
+		dbg("Must provide agent mac address\n");
+		return UBUS_STATUS_INVALID_ARGUMENT;
+	}
+
+	memset(agent, 0, sizeof(agent));
+	strncpy(agent, blobmsg_data(tb[STA_METRIC_QUERY_AGENT]),
+			sizeof(agent) - 1);
+	if (!hwaddr_aton(agent, agent_mac))
+		return UBUS_STATUS_UNKNOWN_ERROR;
+
+	cmdu_data = cntlr_gen_bk_caps_query(c, agent_mac, NULL);
+	if (!cmdu_data)
+		return UBUS_STATUS_UNKNOWN_ERROR;
+
+	send_cmdu(c, cmdu_data);
+	map_free_cmdu(cmdu_data);
+
+	return UBUS_STATUS_OK;
+}
+
 void cntlr_notify_event(struct controller *c, void *ev_type, void *ev_data)
 {
 	struct blob_buf b;
@@ -1714,7 +1761,7 @@ int cntlr_publish_object(struct controller *c, const char *objname)
 	struct ubus_object *obj;
 	struct ubus_object_type *obj_type;
 	struct ubus_method *obj_methods;
-	struct ubus_method m[13] = {
+	struct ubus_method m[14] = {
 		UBUS_METHOD_NOARG("status", cntlr_status),
 		UBUS_METHOD("ap_caps", cntlr_ap_caps,
 				ap_caps_policy_params),
@@ -1738,6 +1785,8 @@ int cntlr_publish_object(struct controller *c, const char *objname)
 		UBUS_METHOD("scan", cntlr_scan, scan_policy_params),
 		UBUS_METHOD("sta_metric_query", cntlr_sta_metric_query,
 				sta_metric_query_params),
+		UBUS_METHOD("bk_caps", cntlr_bk_caps,
+				bk_caps_policy_params),
 		/*
 		UBUS_METHOD("teardown_ap", cntlr_teardown_ap,
 				config_policy_params),