WLAN probe requests' content

Question

I've monitored my home Wifi to check if any of my devices (Windows PC, Linux PC, Samsung phone, iPhone) would send Probe Requests containing the SSID of my home router even if the router is turned off.

By analyzing Wireshark output I notice that my devices only broadcast probe requests with 'SSID=broadcast', unless my router is up and broadcasting its own SSID.

So my question is, does any device/OS sends its registered SSID's list in Probe requests packets even if the targeted router is out of range ? I guess it would be a security leak though...

Answer 1

All Wi-Fi clients must specify the SSID in probes IF they hope to join a "hidden" (a.k.a. "closed", non-broadcast SSID) network.

It's possible that many clients have security optimizations where they make a note of whether any of the remembered/preferred networks were hidden networks, and never bother doing directed (SSID specified) probes if no network they care to try to rejoin was ever known to be a hidden network.

Also, hidden networks usually still have to respond to broadcast (no SSID specified) probe requests, they just respond without the SSID Information Element (IE) or with a zero-length SSID IE, or an SSID IE full of null (0x00) bytes. So it's possible that many clients don't bother doing directed probes unless their broadcast probes show that a hidden network is in range.

So, to REALLY see if your clients could leak an SSID with directed probes even when your network isn't around, follow steps like these:

1. Configure an AP to do a hidden network with a new SSID.
2. Join that network from the clients under test, and tell them to remember that network (add it to the preferred networks list).
3. Turn off your clients for now.
4. Turn off that AP but bring up another AP with a different SSID, also in hidden network mode.
5. Start up your sniffer and then start up your clients. See if they do directed probes revealing your Step 1 AP's SSID, because they knew it was a hidden network, and they see a hidden network in range.