Monday, June 13, 2016

WLAN Scanning





Ever wondered how does your mobile phone or laptop scan for WiFi networks around?

All Wireless radios scan for wlan transmitters continuously. 802.11 b/g/n radios scan in 2.4G frequency band and 802.11 a/ac radios scan in 5G frequency band. WLAN stations listen for beacons,probe responses  and finds out what Access Points (APs) are available in range to connect.

WLAN scanning is of two types:
  •  Passive Scanning
  •  Active scanning
Passive Scanning
All APs select one RF channel for their operation(Like for 2.4G band it could be channel number between 1 to 11  and for 5G band it could be channel 36,40,44,48,52,56,60,64,100, 104,108,112,116,120,124,128,132,136,140,144,149,153,153,157,161 or channel 165) and  send out beacon every 100ms (or more based on beacon interval configured).While doing a passive scan 2.4G WLAN station listens to  beacons  in  channels  allowed for 2.4G band and 5G station will  listen to channels allowed for 5G  frequency band and jolts down the results in the form of SSIDs of the different APs in proximity.

Passive scans are always enabled and can never be disabled because it's a bare minimum requirement for a client to connect to wireless AP.

Passive scan is a time consuming process because a WLAN station has to go to each channel and listen for approximately 200ms to listen to beacons. Once it is done scanning each channel, it will have list of APs in range.


Active Scanning
Active scans can be enabled and disabled based on requirement of the device in radio profile. During active scan,  WLAN station sends a broadcast probe request and listen to the probe responses from other WLAN devices.Active scans are more thorough than passive scans. Probe response received in response to active scan contains SSID and BSSID of an AP.

Active scan is little faster then passive scan and hence the preferred method for operating systems to connect to an AP.In active scan station goes to each channel and sends out either a broadcast probe request(asking any body out there?) or a directed probe request (asking some specific AP say : Hey, Neelam, are you out there ?)  and wait for <= 100ms for probe response and move to next channel.                                                                                                                                                                                                                                                                                                                                                                                                                                


No comments:

Post a Comment