I was wondering how could my computer that uses a spoofed MAC address be sending probe requests for APs that I was never connected to?
Note:- The other computer with the original MAC address was shut down.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
My understanding is that your OS is doing what is called an active scan: periodically sending probe requests to discover the AP's around it. The MAC address or the history of your connections is not relevant in that case.
It is a property of an OS (or you can say wireless card/driver) to automatically scan for the wireless network present in the vicinity.
It is because of this automatic scanning only, we use to get a list of wireless network in wireless settings (without even asked for).
Moreover, if system founds an Open Network, to which it had connected previously in the past, (i.e., wireless network without any security or WebAuth network) in the range, it will automatically connect to it.
Because of this feature only (automatic scanning of the wireless network by devices); Data Analytic companies (or advertisement companies) get to know about the number of users entered in any specific showroom in a shopping mall (or many other similar data sets).
Hope it answers your query.
This is the property of OS to save PNL (preferred network list ) of the devices to which user connects ,so that next when the device comes in the range of AP it automatically connects to it on receiving Beacon frames
changing MAC address cannot make a device alter its PNL , this strange connection to unknown network is to be taken seriously , look for sum installed bug in your device