They could just listen to beacons. Why do they probe for every network you've ever connected to?

Do other wireless devices do this? Does Windows, Linux esp. Kali, do this?

2 Answers 2


That is because listening for a beacon and not getting it just might mean that the network has a private ("hidden") SSID. From this article (emphasis mine):

The 802.11 standard allows APs to beacon with the SSID field set to null - this is referred to as a hidden SSID. A client that wishes to associate with an AP using a hidden SSID must first send out a Probe Request that contains the SSID of that network, which will then cause the AP to provide a Probe Response. For any client that does not provide the correct SSID, the AP does not respond.

I believe that probing can be deactivated in Linux; not sure about Windows, but given their history I'd wager that probing is on by default, and may perhaps be disabled through some obscure registry hack.


Another reason is asymmetry - if you see the AP does not mean the AP sees you. Successful active scan guarantees that you can connect to the AP.

  • This answer does not appear to be in line with WiFi protocols. documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/…
    – schroeder
    Commented Nov 12, 2017 at 0:56
  • @schroeder Passive scanning means you see the AP, active means you see each other. I don't get what your link has to do with my answer. Commented Nov 12, 2017 at 17:53
  • What does scanning have to do with subsequent connections? Either way, the device needs to connect ... So, why default to active scans?
    – schroeder
    Commented Nov 12, 2017 at 17:57
  • Scan results are displayed to the user. There is no need to display APs that doesn't hear our client. Commented Nov 12, 2017 at 18:03
  • what does that have to do with guaranteeing connection? I do not see the logical connection
    – schroeder
    Commented Nov 12, 2017 at 18:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .