A city RoE allows only passive discovery in phase one of a municipal WLAN assessment. What best defines that passive wireless recon?

Passive wireless reconnaissance in phase one of a municipal WLAN assessment means listening for beacons, probe requests/responses, and related management traffic without injecting frames. That approach inventories SSIDs, BSSIDs, channels, and encryption advertisements while minimizing disruption to civic users—exactly what RoE often requires before any active testing. City assessors treat passive discovery as the low-impact foundation for later scoped work. Flooding deauthentication frames to force clients to reveal PSKs immediately fails by concept: deauth is active and disruptive, and it does not make clients “reveal” passphrases in cleartext. Associating to each SSID and running authenticated LAN vulnerability scans fails by concept: that is authenticated/active post-association testing, not passive RF discovery. Standing up a rogue AP that answers every probe fails by concept: a rogue responder is an active, potentially deceptive technique outside passive listening. Exam caveat: “passive” still requires authorization to observe and record RF in the engagement area—do not equate passive with “no RoE needed.” Operational check: place the adapter in monitor mode, run airodump-ng or equivalent without injection, save a labeled survey for the city, and obtain explicit approval before any active probes or deauths in later phases.