256 
Figure 254 Establish a client access 
 
 
Scanning 
A wireless client can get the surrounding wireless network information in two ways, passive scanning or 
active scanning. With passive scanning, a wireless client gets wireless network information through 
listening to Beacon frames sent by surrounding APs; with active scanning, a wireless actively sends a 
probe request frame during scanning, and gets network information by received probe response frames.  
When a wireless client operates, it usually uses both passive scanning and active scanning to get 
information about surrounding wireless networks. 
1.  Active scanning 
When a wireless client operates, it periodically searches for (that is, scans) surrounding wireless 
networks. Active scanning falls into two modes according to whether a specified SSID is carried in a 
probe request. 
•  A client sends a probe request (with the SSID null, that is, the SSID IE length is 0): The client 
periodically sends a probe request frame on each of its supported channels to scan wireless 
networks. APs that receive the probe request send a probe response, which carries the available 
wireless network information. The client associates with the AP with the strongest signal. This active 
scanning mode enables a client to actively get acquainted with the available wireless services and 
select to access the proper wireless network as needed. The active scanning process of a wireless 
client is as shown in Figure 255.  
Figure 255 Active scanning (the SSID of 
the probe request is null, that is, no SSID information is carried) 
 
 
AP 2
Client
AP 1
Pr
ob
e
 
r
e
q
u
es
t
 
(
w
i
t
h
 
n
o
 
SSI
D
)
Pr
o
b
e
 
r
e
q
ue
s
t
 
(
w
i
t
h 
n
o
 
S
SI
D
)
Pr
o
be
 
R
e
s
p
on
s
e
Pr
o
b
e 
R
e
s
p
o
ns
e