How WiFi Probe Requests Track You: What Your Phone Broadcasts to Everyone

Your Phone Is Shouting

Right now, the phone in your pocket is almost certainly broadcasting radio signals that identify it to anyone within range. Not just your cellular connection - your WiFi radio is actively searching for networks, sending out probe requests that contain your device's MAC address and, in many cases, the names of networks you have connected to before.

This is not a bug. It is how WiFi was designed to work. The 802.11 standard includes active scanning as a fundamental mechanism for devices to discover available networks. But what was designed as a convenience feature - helping your phone quickly reconnect to known networks - has become a privacy vulnerability that enables tracking, profiling, and surveillance on a massive scale.

Retailers use probe requests to track customer movements through stores. Advertising companies use them to link your physical location to your online identity. Law enforcement uses them to place suspects at specific locations. And anyone with a $10 WiFi adapter and free software can collect probe requests from every device within range.

What Are Probe Requests?

When a WiFi-enabled device wants to find available networks, it has two options: passive scanning and active scanning.

In passive scanning, the device listens silently on each WiFi channel for beacon frames - the periodic announcements that access points broadcast to advertise their presence. This is slow because the device must wait on each channel long enough to hear a beacon, and beacons are typically sent every 100 milliseconds.

Active scanning is faster. The device sends a probe request frame on each channel, and any access point that receives it responds with a probe response. The device gets responses from all access points on that channel nearly simultaneously, making network discovery much faster. This speed advantage is why most devices default to active scanning.

sequenceDiagram
    participant Phone as Your Phone
    participant Ch1 as Channel 1
    participant Ch6 as Channel 6
    participant Ch11 as Channel 11
    participant AP1 as Home Router
    participant AP2 as Coffee Shop AP
    participant Tracker as Passive Listener
    
    Phone->>Ch1: Probe Request (broadcast)
    Note over Phone: SSID: "HomeNetwork_5G"
    Note over Phone: MAC: AA:BB:CC:DD:EE:FF
    Ch1-->>AP1: No match on this channel
    Ch1-->>Tracker: Captured! MAC + SSID logged
    
    Phone->>Ch6: Probe Request (broadcast)
    Note over Phone: SSID: "Starbucks WiFi"
    Ch6-->>AP2: Match found
    AP2->>Phone: Probe Response
    Ch6-->>Tracker: Captured! Second SSID logged
    
    Phone->>Ch11: Probe Request (broadcast)
    Note over Phone: SSID: "CorpNetwork-Employee"
    Ch11-->>Tracker: Captured! Third SSID logged
    
    Note over Tracker: Profile built:
    Note over Tracker: Device MAC identified
    Note over Tracker: Home network known
    Note over Tracker: Employer identified
    Note over Tracker: Coffee shop habits known

How a passive listener builds a profile from your phone's probe requests across WiFi channels.

A probe request is a management frame defined in the IEEE 802.11 standard. It contains several fields relevant to tracking:

Source MAC address: The device's WiFi hardware address. On older devices and default configurations, this is the real, globally unique MAC address burned into the hardware at the factory. Modern devices randomize this address (more on that below), but the randomization is imperfect.

SSID (Service Set Identifier): The name of a specific network the device is looking for. A device may send directed probes for specific SSIDs or wildcard probes (with an empty SSID field) that ask all access points to respond. Directed probes are the more revealing type because they expose the names of networks the device has previously connected to.

Supported rates and capabilities: Technical parameters describing what the device can do (supported data rates, frequency bands, encryption methods). These parameters can fingerprint the device type and even specific hardware models.

Information elements: Additional data fields that vary by device and driver implementation. These can include vendor-specific information, supported channels, and power capabilities - all of which help narrow down the device's identity.

What Probe Requests Reveal About You

A single probe request is mildly informative. A collection of probe requests from the same device over time is a detailed profile.

The MAC address acts as a unique identifier. If your device uses its real MAC address (as most devices did until 2014), every probe request is tagged with a permanent, globally unique identifier. This lets anyone track your device across time and location. Saw this MAC at the shopping mall at 2 PM? Same MAC at the airport at 6 PM? Same MAC at this hotel lobby for the next three days? You have a travel itinerary.

The SSID list reveals your network history. If your phone probes for "Home_Network_Smith," an attacker knows your name is likely Smith. If it probes for "Marriott_Conference" and "Delta_SkyClub," they know you are a business traveler who flies Delta and stays at Marriotts. If it probes for "FBI_Field_Office_WiFi," they know where you work. The SSID list is a fingerprint of your life patterns.

Unique SSID combinations are even more identifying than individual SSIDs. The probability that two random people have both connected to "SmithFamily_5G" and "SunnysideDayCare" and "YogaStudio_Guest" is vanishingly small. Three or four unique SSIDs typically identify a single individual.

The timing and location of probe requests reveal behavioral patterns. A device that probes at the same location every weekday morning at 8:30 AM is commuting to work. A device that probes at a gym location on Tuesday and Thursday evenings has a workout schedule. A device that probes at a particular residential address every night is likely sleeping there - revealing a home address even if the SSID list does not.

Device fingerprinting through technical parameters identifies the device type even with a randomized MAC. The combination of supported rates, HT capabilities, and vendor-specific information elements can distinguish an iPhone 15 from an iPhone 14, a Samsung Galaxy S24 from an S23, or a Windows laptop from a MacBook. Combined with timing patterns, this can re-identify a device even after a MAC address change.

The Preferred Network List Problem

Every WiFi device maintains a Preferred Network List (PNL) - the list of networks it has connected to before and will automatically reconnect to. When active scanning, many devices send directed probe requests for each network in their PNL.

This creates several problems. First, it broadcasts your network history to everyone within radio range. Second, it enables evil twin attacks - an attacker who sees your device probing for "HomeNetwork" can create a fake access point with that exact name. Your device, thinking it has found a known network, connects automatically, routing all your traffic through the attacker's system.

The PNL accumulates over time. Every hotel WiFi, every airport, every coffee shop, every friend's house - they all get added to the list. A device that has been in use for several years might have dozens or hundreds of SSIDs in its PNL, each one a data point about where the user has been.

The problem is compounded by SSIDs that encode location or organization information. Corporate networks often include the company name. Hotel networks include the hotel brand. Conference networks include the event name. "DEFCON-Open" in your PNL tells an observer that you attend hacking conferences. "Hilton_Honors" says you are a frequent traveler. "ChemotherapyCenter_Guest" reveals medical information.

Some SSIDs are globally unique, effectively acting as geolocation markers. The SSID of a small business, a residential network with a custom name, or a network at a specific venue can be cross-referenced against wardriving databases (like WiGLE.net) to determine the exact latitude and longitude where that network exists. Your device probing for "JoesAutoRepair_WiFi" reveals that you have visited Joe's auto repair shop, and the WiGLE database reveals that Joe's shop is at 123 Main Street in Springfield.

Location Tracking via Probe Requests

The simplest form of probe request tracking requires nothing more than a WiFi adapter in monitor mode and freely available software like Wireshark, Kismet, or Airodump-ng. Place the adapter in a location of interest, capture probe requests, and you have a log of every WiFi device that passed within range (typically 30 to 100 meters, depending on the adapter and antenna).

For more precise location tracking, multiple receivers can triangulate a device's position. Three or more receivers at known positions, each recording the signal strength of probe requests from the same MAC address, can estimate the device's location with meter-level accuracy. This is the basis of indoor positioning systems used by retailers and venues.

graph TD
    subgraph Collection["Data Collection Layer"]
        S1[Sensor - Entrance]
        S2[Sensor - Aisle A]
        S3[Sensor - Aisle B]
        S4[Sensor - Checkout]
        S5[Sensor - Exit]
    end
    
    subgraph Processing["Processing Layer"]
        AGG[Probe Request Aggregator]
        DEDUP[MAC De-duplication]
        TRILAT[Triangulation Engine]
        TRACK[Path Reconstruction]
    end
    
    subgraph Analytics["Analytics Layer"]
        DWELL[Dwell Time Analysis]
        FLOW[Traffic Flow Maps]
        REPEAT[Repeat Visit Detection]
        HEATMAP[Heatmap Generation]
        CONVERT[Conversion Rate Tracking]
    end
    
    subgraph Output["Business Intelligence"]
        REPORT[Management Reports]
        REALTIME[Real-time Dashboard]
        ALERT[Threshold Alerts]
    end
    
    S1 --> AGG
    S2 --> AGG
    S3 --> AGG
    S4 --> AGG
    S5 --> AGG
    
    AGG --> DEDUP
    DEDUP --> TRILAT
    TRILAT --> TRACK
    
    TRACK --> DWELL
    TRACK --> FLOW
    TRACK --> REPEAT
    TRACK --> HEATMAP
    TRACK --> CONVERT
    
    DWELL --> REPORT
    FLOW --> REALTIME
    REPEAT --> ALERT
    HEATMAP --> REPORT
    CONVERT --> REALTIME

Architecture of a commercial WiFi tracking system used in retail environments.

The tracking resolution depends on how frequently the device probes. Most smartphones send probe requests every 15 to 60 seconds when the screen is off and more frequently when the screen is on or when the user opens the WiFi settings. This is frequent enough to track movement through a building or along a street.

Historical tracking is possible by deploying permanent sensors. A network of probe request collectors deployed across a city could, in theory, track any WiFi-enabled device's movements throughout the coverage area. This is not hypothetical - several companies have offered exactly this service to law enforcement and private investigators.

Commercial WiFi Tracking Systems

WiFi tracking is a commercial industry. Companies like Euclid Analytics (acquired by Aruba/HPE), RetailNext, and ShopperTrak have sold probe request tracking systems to retailers, shopping malls, airports, and event venues for over a decade.

These systems typically deploy WiFi sensors throughout a venue to collect probe requests from visitor devices. The data is processed to generate analytics: foot traffic counts, dwell times, movement paths, repeat visit rates, and conversion metrics (how many people who entered the store walked past the checkout). The stated purpose is business intelligence - understanding customer behavior to optimize store layouts, staffing, and marketing.

The privacy implications are significant. Even with MAC randomization, these systems can track devices within a single visit by correlating probe request characteristics. Some systems attempt to link visits over time using device fingerprinting techniques. When combined with loyalty program data (which links a specific phone to a named individual), the anonymous tracking data becomes personally identified.

Regulatory responses have varied. The GDPR in Europe treats MAC addresses as personal data, requiring consent for collection. Some jurisdictions have enacted specific laws against WiFi tracking without notice. In practice, enforcement is sparse and most consumers are unaware that tracking is occurring.

iOS 14 and Android 10 Changes

Apple and Google introduced significant privacy improvements for probe requests starting around 2014, with major enhancements in iOS 14 (2020) and Android 10 (2019).

MAC address randomization is the primary defense. Instead of using the real hardware MAC address, the device generates a random MAC address for probe requests. This breaks the persistent identifier that made long-term tracking trivial.

iOS 8 (2014) introduced random MAC addresses for probe requests when the device was not associated with a network. iOS 14 went further, using a different random MAC address for each WiFi network the device connects to. This means the MAC address your phone uses at home is different from the one it uses at the coffee shop, making cross-location tracking harder.

Android followed a similar timeline. Android 8 (2017) introduced randomized MACs for probe requests. Android 10 (2019) made per-network randomized MACs the default. Android 12 added per-SSID randomization that changes more frequently.

SSID hiding was another major improvement. Modern versions of iOS and Android no longer broadcast directed probe requests containing SSIDs from the PNL (with some exceptions). Instead, they send wildcard probes with empty SSID fields, waiting for access points to identify themselves via beacon frames. This eliminates the PNL leakage problem for most devices running current software.

Reduced probing frequency decreases the rate at which devices send probe requests when not actively searching for networks. Some implementations delay probing until the user activates the screen or opens WiFi settings, reducing the window for passive collection.

What Still Leaks

MAC randomization and SSID hiding significantly improved privacy, but they are not complete solutions.

Randomization is not always truly random. Research has shown that some implementations reuse random MACs in predictable patterns or change them at regular intervals, creating opportunities for correlation. A device that changes its MAC every 15 minutes but keeps the same MAC for 15 minutes at a time can still be tracked within that window.

Information elements remain consistent across MAC changes. The technical capabilities advertised in probe requests (supported rates, HT capabilities, vendor-specific elements) remain constant because they reflect the hardware. These can be used to fingerprint specific device models and, combined with other signals, to re-identify devices after MAC changes.

Sequence numbers may leak. The 802.11 frame sequence number increments with each frame sent. If a device changes its MAC but continues incrementing the sequence number, an observer can correlate the old and new MACs through the sequence continuity.

Connected MACs are less random. When a device is associated with a network, many implementations use a consistent per-network random MAC. This MAC does not change across sessions, making the device trackable within that network's coverage area. The random MAC used at your office WiFi is stable, meaning your employer can track your device's presence over time.

Some SSIDs still leak in specific circumstances. Hidden networks (those that do not broadcast their SSID in beacons) require the client to send directed probes with the SSID included. If you have ever connected to a hidden network, your device may still broadcast that SSID in probe requests, even on modern OS versions.

Protecting Yourself

Complete protection against probe request tracking requires a combination of software settings and behavioral changes.

Keep your OS updated. The most significant privacy improvements come from operating system updates. Running the latest version of iOS or Android ensures you have the most current MAC randomization and SSID hiding implementations.

Turn off WiFi when not in use. The simplest and most effective defense. A radio that is off cannot send probe requests. Most modern phones have quick toggles for WiFi in the notification shade or control center. Be aware that some implementations only disconnect from the current network when you toggle WiFi from the control center - you may need to go into Settings to fully disable the WiFi radio.

Prune your PNL regularly. Remove networks you no longer use. Every SSID in your PNL is a potential data leak, even if modern OS versions usually hide them. Keeping the list short reduces the information available if a leak occurs.

Avoid hidden networks. Connecting to a hidden network forces your device to send directed probes with the SSID, bypassing the protections that prevent PNL leakage. If you must use a hidden network, consider forgetting it when you leave.

Use a VPN when on public WiFi. This does not prevent probe request tracking but protects your traffic content once connected. The probe request threat and the network eavesdropping threat are separate layers of the same problem.

Detection and Analysis Tools

Understanding what your devices broadcast requires the ability to capture and analyze WiFi management frames. Several tools are available for this.

Wireshark with a WiFi adapter in monitor mode captures all 802.11 frames, including probe requests. Filter with "wlan.fc.type_subtype == 0x04" to see only probe requests. This shows the raw data including MAC addresses, SSIDs, and all information elements.

Kismet is a wireless network detector and sniffer that automatically logs probe requests along with signal strength and timestamps. It provides a real-time view of all wireless devices in range and their probing behavior.

Probemon and Probequest are purpose-built tools for probe request analysis. They parse captured probe requests and present them in a readable format, making it easy to see which devices are probing for which networks.

The BLEShark Nano, while primarily a BLE tool, operates in the same 2.4 GHz space as WiFi. Understanding the wireless environment around you - both BLE and WiFi - is the first step in assessing your exposure to wireless tracking. The BLEShark Nano's ability to detect and analyze BLE advertisements complements WiFi probe analysis by revealing the full picture of wireless emissions from your devices and your environment.