title: What methods, other than listening for Probe Requests, can be used to find 802.11 wifi devices?
body: <p>I'm writing a Python module for finding nearby WiFi client devices. All my current scanner does is listen for Probe Requests and logs the clients MAC address.</p>
  
  <p>The problem I'm having is that I'm completely reliant on the device broadcasting a probe request for me to discover it. </p>
  
  <p>I'm wondering if there is any other way to discover devices. Using <a href="http://www.wi-fiplanet.com/tutorials/article.php/1447501/Understanding-80211-Frame-Types.htm" rel="nofollow">this site</a> as a 802.11 guide, I've come up with the ideas:</p>
  
  <ul>
  <li>Send out Broadcast packets with generic SSIDs to see if clients respond. For example, sending out a broadcast with 'Netgear' as the AP SSID and see if any clients with known 'Netgear' profiles respond</li>
  <li>Send out disassociation packets to force already connected clients to rescan the airwaves</li>
  </ul>
  
  <p>I haven't tested these two ideas yet. Just spit balling.</p>
  
  <p>Thoughts?</p>