Why do WiFi devices broadcast?

Question

I may be missing something about how WiFi and networking in general works, but I do know how WiFi device tracking works.

When eg. an Android phone has WiFi on, it's sending a ping/broadcast message every few seconds. Using this message eg. retailers can track the location of the device by triangulating the message between multiple wifi hotspots.

My question is, why does the Client broadcast this message at all? Why is it not only the access point that sends the "I am here, connect to me" messages. There should be no WiFi traffic from my device until I try to connect to something, and yet it gives away my location and device id every few seconds.

You could then do the reverse only for hidden SSID networks, and encrypt the probe with something unique to that network and time, only sending a probe in the current style when you set up the network the first time.

This would stop the real time tracking of specific devices, no?

Answer 1

It's more efficient.

Your device can either perform an active or a passive scan. In a passive scan, the device waits until it captures beacon frames from access points that advertise themselves. In an active scan, you are sending probe requests yourself and wait for APs to respond - this is what most smartphones do.

Passive scanning should be the preferred method in terms of security since it is entirely anonymous, not broadcasting any information about the device. But it also has a negative impact on performance and latency:

The beacon (by default) is only transmitted every 100TU (102,400μs). To have some hope of hearing most Access Points, you’ll need to wait for 2 beacon intervals – say 102,400μs x 2 per channel. We have 12 (or 14 in some areas) channels in the 2.4Ghz band, so a full scan would take 102,400μs x 2 x 12 = 2,457,600μs or about 2.5 seconds.

During this time, the receiver is in a high power usage mode – so battery life is negatively impacted and power usage for a wifi adapter sky-rockets. Sure, you can only run a scan lets say, every 30 seconds – but that still means you have the receiver powered up for 5 seconds out of every minute.

Active scanning is more efficient:

The power requirements are much lower – after the initial probe request, the adapter only listens for a fraction of time compared to a passive scan (although this varies per manufacturer and driver).

(Source)

Besides performance problems, hidden networks that don't send beacons regularly also wouldn't be picked up at all. For devices that use wifi information to enhance the location services (like Android does), active scanning presumably also increases the accuracy.