Open Wifi SSID Broadcast vulnerability

Figure 2: Direct Probe
Figure 3: Broadcast Probe
Broadcast probe: The client sends a broadcast probe request with a null
SSID where all APs receiving this, would respond with a probe-response for
each of the SSID they support. (Figure 3)
2.3.2 Passive Scan
In passive scanning, the client also tunes into the radio frequency it wants to
scan through, yet instead of sending a probe request it waits[2, p. 978] for a
broadcast beacon from the available APs.
Figure 4: Passive Scan
4