Preferred Network List (PNL)
Definition
The list of previously joined Wi-Fi networks stored on a client device. The device automatically probes for networks on the PNL when scanning. Recovered from device storage during acquisition, the PNL reveals a history of networks the device has joined and the locations associated with them.
- Stored on
- Client device (phone, laptop, tablet)
- Content
- Previously joined Wi-Fi networks
- Behavior
- Device probes for PNL networks when scanning
- Forensic value
- Reveals network and location history
Common questions
Why is the PNL considered a location-history artefact?+
Each remembered network name is typically tied to a specific place, such as a home, workplace, or previously visited venue, so recovering the PNL and correlating network names or BSSIDs with known locations can reconstruct where a device, and by inference its user, has been.
What privacy risk does active PNL probing create?+
Older devices broadcast probe requests containing PNL network names even when not connected, which passive Wi-Fi sniffers can capture to build a profile of a device's network history, a risk modern operating systems mitigate through randomized MAC addresses and passive scanning.
Related terms
- BSSID
- Basic Service Set Identifier. The MAC address of a specific access point radio. Used in association logs and packet captures to uniquely...
- MAC Address Randomisation
- A privacy mechanism in modern operating systems that substitutes a randomly generated MAC address for the device's globally unique burned-in address during...
- Monitor Mode
- An 802.11 radio mode that captures every wireless frame in range, including management and control frames, without associating to an access point....
- Probe Request
- An 802.11 management frame broadcast by a client device when actively scanning for Wi-Fi networks. Contains the device MAC address and, in...
- RSSI
- Received Signal Strength Indicator. A value, typically expressed in dBm, recorded in access-point logs and packet captures that indicates how strongly a...