Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to find some information on how cellphones discover which wireless networks are in range? Is it via ARP or DHCP discover? Also how often does a cellphone do this polling?

I can't find any detailed information anywhere.

share|improve this question

closed as off topic by AJ Henderson, Iszi, dr jimbob, Rory Alsop Mar 21 '13 at 19:37

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

This has nothing to do with security and doesn't fit the content of the site, which is focused on IT Security related topics and concerns. It may be a better fit for superuser. – AJ Henderson Mar 21 '13 at 18:02
In a sense, I couldn't find a networking stack exchange. The reasons for asking this is security. I am interested in what information a cellphone provides to wireless APs on it's own. – nickponline Mar 21 '13 at 19:28
up vote 6 down vote accepted

Let's not mix things. Modern cell phones can use at least three different "wireless" protocols:

  • The main "phone" protocol, in all its incarnations (CDMA, GSM, GPRS, UMTS...), from which comes the expression "cell phone". The phone "number", SMS and voice channels use that. That's the protool for which you pay your provider.

  • WiFi, aka "802.11". Shorter range (up to 100m or so). It allows generic IP communications (aka "the Internet") and is subject to whoever handles the access point. That's what you use when you have "free WiFi" in a restaurant, or with the WiFi router you have at home.

  • Bluetooth. Even shorter range (10m or so). Cell phones use that to talk with custom ear plugs, or other phones in immediate vicinity.

In all these protocol, any system or device which acts as "access points" simply broadcasts at regular intervals a message stating "I am an access point, please talk to me". (Edit: as @Iszi says, a WiFi AP can be configured to avoid broadcasting; in which case the user on the device must manually enter the SSID, and that's the phone or laptop which will begin the conversation by asking whether the AP is listening.)

ARP and DHCP occur at quite another level. They are protocols used when a local transport medium is already active (typically Ethernet or WiFi). ARP is used when one machine connected to the medium wants to send an IP packet to another machine on the same medium, but for which it knows only the IP address. Say, suppose that machine A wants to talk to machine B. A knows that B's address is (that's an example). To send an ethernet frame, it must know B's MAC address. To learn it, A broadcasts on the transport medium a message which says "who has address ?". If someone listening on the medium knows, then that someone will respond " is owned by machine with MAC 80:03:AC:0F:D4:CC". At least B is supposed to answer for itself. This request and the response are the ARP protocol.

DHCP is when a machine joins the transport medium (e.g. the cable was just plugged), and wants to obtain an IP address so that it may talk with other machines on the Internet. The DHCP request is, there again, a message broadcast on the transport medium. The message says: "hellllo there, I am a newcomer, what IP should I use ?". If a DHCP server is listening on the medium, it will answer "from now on thou shallt be known as; the gateway to other realms is; send thy requests for name resolution to the DNS on".

A cell phone, or a laptop computer, or a tablet, when faced with a WiFi access point, will do things in the following order:

  1. The WiFi AP sends a broadcast signal "I am an AP ! Yes I am ! I am significant !".
  2. The phone/laptop/tablet nags the human user ("there's a WiFi AP here !").
  3. The user triggers the connection (depending on the device configuration, this might be automatic).
  4. The phone/laptop/tablet goes through the network moves which incarnate the joining of the WiFi network.
  5. The phone/laptop/tablet sends a DHCP request over the newly joined WiFi network, so that it obtains an IP address.
  6. The DHCP server (typically the WiFi AP itself) grants an IP address to the phone/laptop/tablet, and gives the other parameters: the gateway for IP packets which go beyond the local network, and the DNS to use to turn machine names into IP addresses. The gateway and the DNS will typically be the WiFi AP itself.
  7. The phone/laptop/tablet wants to open an URL in its Web browser. To do that, it will need to talk to the DNS to know the address of the Web server. It knows the IP address of the DNS; to really talk to it, it needs the MAC address of the DNS (or the MAC address of the gateway, if the DNS is not on the local WiFi network). Thus, ARP.
share|improve this answer
You forgot to cover what happens when people turn off AP broadcasting "for security". Then, the phone is the one initiating the conversation: "Hey, AP! Are you around here anywhere? Hello, AP? Are you there?" – Iszi Mar 21 '13 at 18:29
Nice suggestion. Fixed. – Thomas Pornin Mar 21 '13 at 18:50
but which protocol is used to send the "I am an access point, please talk to me"? I believe that will answer the question. – htafoya Aug 24 '14 at 8:37

Public APs, the ones that your phone might stumple upon, periodically broadcast a beacon frame that has all of the essential information needed to create a connection to an AP. The wikipedia article is incomplete but at least it gives the basic components: Cell phones that have wifi capability use their internal antenna to capture and identify these packets just like (well very similar to) any other wireless nic.

Search on 802.11 Beacon Frame for more information.

share|improve this answer
So the cellphone doesn't initiate the connection, the AP does? – nickponline Mar 21 '13 at 17:45
The phone will initiate the connection utilizing information contained in the beacon frame OR that is pre configured in the device. For example, you might have a private AP that isn't broadcasting. Your phone could still connect to that AP if you know certain information, such as the ESSID. Once the device(phone) negotiates a connection to the AP it is connected to that network and 'normal' networking protocols take over. The device does initiate the connection, but the AP is identified (re: your question) through a beacon frame or direct specification. – grauwulf Mar 21 '13 at 17:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.