> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/hacking-wifi/wpa-wpa2-psk-network-attacks/packet-analysis/probe-request-packet-analysis.md).
# Probe Request Packet Analysis
Identify and analyze Wi-Fi probe request packets in an authorized capture.
### Overview
A client sends probe requests during active Wi-Fi scanning. It can send them before joining a network. It can also send them while already connected.
These management frames help the client discover nearby access points. The request can name a specific SSID. It can also use a wildcard SSID to request any available network.
Analyze captures from networks you own or are authorized to assess. Probe requests can expose device identifiers and requested network names.
### Observe probes with Airodump-ng
Run Airodump-ng on the monitor-mode interface:
{% code overflow="wrap" %}
```bash
airodump-ng wlan0mon
```
{% endcode %}
In the **STATION** section, review the **Probes** column. It lists SSIDs requested by observed clients.
An empty value does not rule out probe activity. The client may use a wildcard request. The capture may also miss the frame.
### Filter probe requests
Probe requests use management-frame subtype `4`. Filter a saved capture with Tshark:
{% code overflow="wrap" %}
```bash
tshark -r CAPTURE-01.cap -Y "wlan.fc.type_subtype == 4" 2>/dev/null
```
{% endcode %}
### Inspect a specific client
Filter the results by the client source address:
{% code overflow="wrap" %}
```bash
tshark -r CAPTURE-01.cap -Y "wlan.fc.type_subtype == 4 && wlan.sa == AA:BB:CC:DD:EE:FF" 2>/dev/null
```
{% endcode %}
Replace `AA:BB:CC:DD:EE:FF` with the client MAC address from your authorized capture.
### Review packet fields
Open a matching frame in Wireshark or use verbose Tshark output:
{% code overflow="wrap" %}
```bash
tshark -r CAPTURE-01.cap -Y "wlan.fc.type_subtype == 4" -V 2>/dev/null
```
{% endcode %}
Review these fields:
* **Source address** identifies the transmitting client.
* **Destination address** is often broadcast during general discovery.
* **SSID** identifies a directed request, or remains empty for a wildcard request.
### Interpret the results
A probe request shows a client scanning at that moment. It does not prove a successful connection.
Use timestamps, source addresses, and SSID values to correlate requests. Compare them with beacon, probe response, and association frames in the same capture.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/hacking-wifi/wpa-wpa2-psk-network-attacks/packet-analysis/probe-request-packet-analysis.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
