Do Android devices make active or passive scan when looking for WiFi AP I would like to know if Android devices make active or passive scan when looking for the AP to connect. I've already made a test using Wireshark and wifi sniffer and it seems that while an iPhone sends Probe Request frames to discover available APs (active scan), my Android device sometimes sends Probe Request frame, but most of the times it does not send Probe Request frames at all, but waits for the AP to send a Beacon frame (passive scan).

I've been looking for some official info/documentation concerning this topic, but haven't found anything useful yet. I would be very grateful if someone could provide me with the answer to this question.
The only &quot;official&quot; explanation I found is in this comment (dated July 2009) in the Git repositories on android:

wifi: WifiManager.startScan() will now do passive scans by default.
Active scans will only happen if an hidden AP is in use, or if the new method
WifiManager.startScanActive() is called.

The existence of an hidden function to start an active scan (reported here) suggests that the normal scanning function is indeed passive. This is to be taken with a grain of salt, though, as the Android documentation doesn't explicitly tell if the function WifiManager.startScan() is passive or not.
Also related: this two posts on SO (post 1, post 2) report that the scanning activity is passive (post 1) and that since android 4.3 it not even possible to call the active scan method (post 2) - but there is no link to official sources.