I'm looking at WLAN traffic captured from wireshark on monitor mode and notice that out of the 67,000 probe requests, 99.08% have the destination set to FF:FF:FF:FF:FF:FF (Broadcast).

The thing is, it appears as though a substantial chunk of those 67K Probe Requests were directed to specific SSIDs.

My question is, if a Probe Request is directed to a specific SSID, shouldn't the destination address be included? (and not the generic 'Broadcast' destination)

  • Clarify: are you talking about the client probes looking for specific SSIDs, or the beacons from the AP announcing the availability of SSIDs? – Ricky Jan 12 '14 at 3:35
  • Client probes looking for specific SSIDs. – JHAWN Jan 15 '14 at 7:14
  • If someone has provided an answer that resolves your question, please consider marking it as the accepted answer. This will reward both the person who provided the answer and yourself with additional reputation. If you do not do so, your question will periodically get refreshed back to the main page, possibly distracting community members from other questions they may be able to help answer for other users. Thank you. – YLearn Dec 12 '15 at 0:40
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin Jan 4 at 22:16

To understand the answer to this question, you need to understand some wireless terminology.

The service set identifier or SSID is the logical (i.e. human readable) name used by a wireless network.

The basic service set or BSS consists of a single access point (or virtual access point) and any stations associated to the AP (VAP). Each WLAN that an AP provides service for will use a 48-bit address as the BSSID for the BSS, which is very similar to a MAC address (and may use the MAC address of the AP).

The extended service set or ESS consists of one or more BSS connected to the same network.

The SSID is actually more related to the ESS than the BSS, and most client devices don't care which specific BSS they join, rather they look to join the ESS. This is very advantageous in multiple AP environments as this allows the station to choose a better AP to connect (rather than a specific BSSID which may be further away with weaker signal/lower performance).

Some clients (especially most *nix based clients) will actually allow you to optionally select a BSSID as well. This can be more secure as it will prevent your client from connecting to a "rogue" access point that is broadcasting the same SSID as the network you expect to connect.

  • 2
    This is the simplest explanation of BSSID / BSS / ESS I have seen. – Mike Pennington Jan 11 '14 at 23:21
  • I collected many Beacons with multiple BSSIDs for the same SSID. This has answered so many questions. – JHAWN Jan 12 '14 at 3:19
  • Many Windows systems support it as well -- advanced function, AP security. (limits which APs with which it's allowed to connect. not very good security, but still) – Ricky Jan 12 '14 at 3:33

My question is, if a Probe Request is directed to a specific SSID, shouldn't the destination address be included?

No, SSID probes are normally broadcast.

Probe requests are either broadast or unicast check to see whether an SSID is in range. It's like the NIC is continuously asking "is anybody there?", or "is Bob there?". Since many companies deploy multiple APs on the same SSID, it makes sense to broadcast SSID probes.


Remember that if you visit a restaurant / hotel and connect to their free wifi using your phone, that SSID is cached indefinitely and your phone will continuously broadcast that SSID to check whether the AP might be in range now. By using a wireless sniffer, you can discover a lot about a person's habits just by watching the probe requests from their phone.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.