Probe Request
Definition
An 802.11 management frame broadcast by a client device when actively scanning for Wi-Fi networks. Contains the device MAC address and, in many implementations, the SSIDs of previously joined networks. Captured in plaintext by any monitor-mode receiver in range.
- Layer
- 802.11 Wi-Fi management frame
- Contains
- Device MAC address, prior SSIDs
- Transmission
- Broadcast in plaintext
- Use
- Device presence tracking
Common questions
Why are probe requests useful in an investigation even without joining a network?+
A phone or laptop broadcasts probe requests continuously while scanning for known networks, so an investigator with a monitor-mode receiver can log which devices were present at a location and, often, the names of networks those devices have previously connected to, without needing to compromise or join any network.
Does MAC address randomisation defeat probe request tracking?+
It substantially weakens it. Modern phones rotate a randomised MAC address for probe requests when not connected to a saved network, so an analyst can no longer reliably link probes to one device over time using the MAC alone, though SSID history and timing patterns can sometimes still assist correlation.
Related terms
- BSSID
- Basic Service Set Identifier. The MAC address of a specific access point radio. Used in association logs and packet captures to uniquely...
- MAC Address Randomisation
- A privacy mechanism in modern operating systems that substitutes a randomly generated MAC address for the device's globally unique burned-in address during...
- Monitor Mode
- An 802.11 radio mode that captures every wireless frame in range, including management and control frames, without associating to an access point....
- Preferred Network List (PNL)
- The list of previously joined Wi-Fi networks stored on a client device. The device automatically probes for networks on the PNL when...
- RSSI
- Received Signal Strength Indicator. A value, typically expressed in dBm, recorded in access-point logs and packet captures that indicates how strongly a...