A help desk asks what a probe request is doing when a laptop is not yet connected to city Wi-Fi. What is correct?
Select an answer to reveal the explanation.
Short Explanation
The laptop is shouting “anyone named CityGuest?” into the hallway before it has a room key. That’s probing—and attackers listen for those preferred names too.
Full Explanation
While not yet associated, client stations send probe requests to discover available networks and often include preferred SSID lists from their saved profiles. Those probes help legitimate recon map demand for civic SSIDs and also underpin themes such as evil-twin attraction when a rogue AP answers a sought name. Help desks should understand probing as normal pre-association management behavior, not as proof the laptop is already fully connected to city Wi-Fi or finished with encryption setup. Claiming probe requests only occur after a full 4-way handshake reverses order: probing is discovery before association and key installation. Saying probe requests are AP beacons renamed by Windows for branding confuses client-originated probes with AP beacons. Asserting unconnected clients cannot transmit any 802.11 management frames is false and would blind analysts to useful recon signals. Exam caveat: Preferred-network lists in probes can leak SSIDs users have joined before—handle that privacy-sensitive recon carefully under RoE and retention limits. Operational check: In monitor mode near city Wi-Fi, observe probe requests from unassociated laptops and note directed SSIDs without associating yourself unless the engagement explicitly authorizes that next step.