I'm trying to find some information on how cellphones discover which wireless networks are in range? Is it via ARP or DHCP discover? Also how often does a cellphone do this polling?
I can't find any detailed information anywhere.
Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.
Let's not mix things. Modern cell phones can use at least three different "wireless" protocols:
In all these protocol, any system or device which acts as "access points" simply broadcasts at regular intervals a message stating "I am an access point, please talk to me". (Edit: as @Iszi says, a WiFi AP can be configured to avoid broadcasting; in which case the user on the device must manually enter the SSID, and that's the phone or laptop which will begin the conversation by asking whether the AP is listening.)
ARP and DHCP occur at quite another level. They are protocols used when a local transport medium is already active (typically Ethernet or WiFi). ARP is used when one machine connected to the medium wants to send an IP packet to another machine on the same medium, but for which it knows only the IP address. Say, suppose that machine A wants to talk to machine B. A knows that B's address is 10.0.1.17 (that's an example). To send an ethernet frame, it must know B's MAC address. To learn it, A broadcasts on the transport medium a message which says "who has address 10.0.1.17 ?". If someone listening on the medium knows, then that someone will respond "10.0.1.17 is owned by machine with MAC 80:03:AC:0F:D4:CC". At least B is supposed to answer for itself. This request and the response are the ARP protocol.
DHCP is when a machine joins the transport medium (e.g. the cable was just plugged), and wants to obtain an IP address so that it may talk with other machines on the Internet. The DHCP request is, there again, a message broadcast on the transport medium. The message says: "hellllo there, I am a newcomer, what IP should I use ?". If a DHCP server is listening on the medium, it will answer "from now on thou shallt be known as 10.0.1.17; the gateway to other realms is 10.0.1.1; send thy requests for name resolution to the DNS on 10.0.1.42".
A cell phone, or a laptop computer, or a tablet, when faced with a WiFi access point, will do things in the following order:
Public APs, the ones that your phone might stumple upon, periodically broadcast a beacon frame that has all of the essential information needed to create a connection to an AP. The wikipedia article is incomplete but at least it gives the basic components: http://en.wikipedia.org/wiki/Beacon_frame Cell phones that have wifi capability use their internal antenna to capture and identify these packets just like (well very similar to) any other wireless nic.
Search on 802.11 Beacon Frame for more information.