I'm looking at WLAN traffic captured from wireshark on monitor mode and notice that out of the 67,000 probe requests, 99.08% have the destination set to FF:FF:FF:FF:FF:FF (Broadcast).
The thing is, it appears as though a substantial chunk of those 67K Probe Requests were directed to specific SSIDs.
My question is, if a Probe Request is directed to a specific SSID, shouldn't the destination address be included? (and not the generic 'Broadcast' destination)
To understand the answer to this question, you need to understand some wireless terminology.
The service set identifier or SSID is the logical (i.e. human readable) name used by a wireless network.
The basic service set or BSS consists of a single access point (or virtual access point) and any stations associated to the AP (VAP). Each WLAN that an AP provides service for will use a 48-bit address as the BSSID for the BSS, which is very similar to a MAC address (and may use the MAC address of the AP).
The extended service set or ESS consists of one or more BSS connected to the same network.
The SSID is actually more related to the ESS than the BSS, and most client devices don't care which specific BSS they join, rather they look to join the ESS. This is very advantageous in multiple AP environments as this allows the station to choose a better AP to connect (rather than a specific BSSID which may be further away with weaker signal/lower performance).
Some clients (especially most *nix based clients) will actually allow you to optionally select a BSSID as well. This can be more secure as it will prevent your client from connecting to a "rogue" access point that is broadcasting the same SSID as the network you expect to connect.
My question is, if a Probe Request is directed to a specific SSID, shouldn't the destination address be included?
No, SSID probes are normally broadcast.
Probe requests are either broadast or unicast check to see whether an SSID is in range. It's like the NIC is continuously asking "is anybody there?", or "is Bob there?". Since many companies deploy multiple APs on the same SSID, it makes sense to broadcast SSID probes.
Tangent:
Remember that if you visit a restaurant / hotel and connect to their free wifi using your phone, that SSID is cached indefinitely and your phone will continuously broadcast that SSID to check whether the AP might be in range now. By using a wireless sniffer, you can discover a lot about a person's habits just by watching the probe requests from their phone.
