A Characterization of Wireless NIC Active Scanning Algorithms

In this paper we characterize the proprietary active scanning algorithms of several wireless network interface cards (WNICs) and driver combinations. We believe our experiments are the first of their kind to observe the complete scanning process as the WNICs probe all the channels in the 2.4GHz spectrum. We discuss the 1) channel probe order; 2) correlation of channel popularity during active scanning and access point (AP) channel deployment popularity; 3) number of probe request frames (PRFs) sent on each channel across WNICs; 4) amount of time spent on each channel across WNICs (dwell time); and 5) variation in scanning algorithms. The knowledge gained from profiling WNICs is of significant importance to numerous disciplines. It enables us to understand different implementations (hardware and software) of active scanning. The same knowledge can help lay a foundation for implementing active scanning in network simulators. It is generically considered in only one of the popular simulators. Finally, the results from our work can also radically influence research in link-layer handovers, effective deployment of access points (APs), securing wireless networks, etc.