Do cellphones periodically send a "hello" msg to nearby WiFi APs?

Question

I recently stumbled on this site, offering cell phone detection solutions: http://www.libelium.com/products/meshlium/smartphone-detection/

Where they state that:

Users have to do nothing to be detected as the WiFi and Bluetooth radios integrated in their Smartphones (Mobile, Hand and Cell Phones) periodically send a "hellow!" message telling about their presence.

In addition, using this method they say, that they can record the mac adresses of nearby devices and a bunch of other information.

However I am suprised about this "hello" msg being periodically send by mobile phones.

What is its purpose and how does it work? Why would something like this be periodically sent to all WiFi networks? What is there to gain?

Is the detection device simply a WiFi router with added functionality to record these hello msgs or is there something more going on?

Answer 1

Regarding the "hello" message

This is actually the probe request. Every so often your phone (or laptop etc) will send a probe request to see if any of the access points that it already knows about are around. You can view this in a wireshark capture, and at this link. Control+Find for "Probe Request Frame". You will see that the client (the phone) sends this probe. Inside this probe is the mac address of the device, as well as the SSID (wifi access point name) that it is searching for.

Is the detection device simply a WiFi router with added functionality to record these hello msgs?

Essentially, yes. Any wireless card that can enter promiscuous mode can passively record these wireless probes. So not necessarily a router is needed.

If your wheels are turning and you think "well what if someone just answered 'yes' to all of those probes? Could they attack me?" Although somewhat less effective today, you can start your search on slide 29 here.