Chapter 2 - Scanning Methods

Active Scanning with Probe Request and Probe Response frames

To connect to an AP, you first must find it. To do so, there is a discovery process that needs to take place. Like many things, you can actively look for them, or you can just sort of… find them… passively.

Active Scanning
 

When STA's actively look for SSID's they send out Probe Requests. These probe requests can specify the SSID that they are looking for, or look for any BSS that is able to hear the request and will answer. Basically "Hey Frank, you there?" versus " Is there anybody out there?"

AP's that hear these requests respond with probe response frames. These are essentially beacon frames, containing almost all of the same information except for the TIM element. If an AP hears a request with a wildcard SSID, it will respond with a probe response containing all of its SSIDs.

There are a couple of important things to note here. Often, a STA will be within "hearing-range" of multiple AP's. So if that STA sends out a probe request *all* of the AP's that can hear it will respond. Also important to remember is that your AP's are all going to be on different, non-overlapping channels. (Right?!?) So to be able to find those AP's the STA will have to broadcast its probe request on all channels its configured to use. However even this is a little bit of an oversimplification. The actual process looks more like this.

1.) STA switches to a channel

2.) It starts a ProbeDelay countdown timer, while this is ticking by it is listening for an incoming frame.

3.) If the ProbeDelay timer expires without the STA hearing a frame. It will gain access to the medium and send a probe request. (Remember even when its just looking for an AP, it still has to be a good steward of the medium and ensure its not being used before broadcasting.)

4.) Wait for the MinChannelTime to pass - If the medium was never busy and nothing responds, then there is no WLAN on the channel and it can move to the next channel and start its search over again. However if the medium was in fact busy at some point it will wait until the MaxChannelTime expires and then will look at any probe response frames that have come in.

Passive Scanning

Remember that Beacons are sent from AP's in regular intervals. So in order to find AP's all a STA needs to do is sit there and listen for beacons to find AP's to connect to. If it hears multiple beacons it will parse through them to determine the AP with the strongest signal and start the authentication and association process.