Active scanning (Probes)
. . . .

---

Active scanning (Probes)

• In addition to passively scanning for APs, client stations can actively scan for them.
• In active scanning, the client station transmits management frames known as probe requests.
• These probe requests either can contain the SSID of the specific WLAN that the client station is looking for or can look for any SSID.
• Directed probe request: A probe request with the specific SSID information
  • A client station that is looking for a specific SSID sends a probe request with the SSID field set to the specific SSID.
  • If a directed probe request is sent, all APs that support that specific SSID and hear the request should reply by sending a probe response.
• Null probe request: A probe request without the SSID information
  • A client station that is looking for any SSID sends a probe request with the SSID field set to null.
  • If a null probe request is sent, all APs that hear the request should reply by sending a probe response, as shown in Figure 9.5.
• The information that is contained inside the body of a probe response frame is the same information that can be found in a beacon frame, with the exception of the traffic indication map (TIM).
• Just like the beacon frame, the probe response frame contains all of the necessary information for a client station to learn about the parameters of the basic service set before joining the BSS.
  
• One drawback to passive scanning is that beacon management frames
  are broadcast only on the same channel as the AP.
• In contrast, active scanning uses probe request frames that are sent out across all
  available channels by the client station.
• If a client station receives probe responses from multiple APs, signal strength and quality
  characteristics are typically used by the client station to determine which AP has the best signal and thus which AP to connect to.
  
• The client station will sequentially send probe requests on each of the supported channels.
• In fact, it is common for a client station that is already associated to an AP and transmitting data to go off-channel and continue to send probe requests every few seconds across other channels.
• By continuing to actively scan, a client station can maintain and update a list of known APs, and if the client station needs to roam, it can typically do so faster and more efficiently.
• How often a client station goes off-channel for active scanning purposes is proprietary.
• For example, an 802.11 radio in a mobile device such as a smartphone or tablet will probably send probe requests across all channels more frequently than an 802.11 radio in a laptop.
  

Figure 9.5 Active scan

---

Reference:
Coleman, David D.,Westcott, David A. CWNA: Certified Wireless Network Administrator Official Study Guide: Exam CWNA-106 Wiley.