Sniffer-based inference of the causes of active scanning in WiFi networks

Active scanning (AS) is a mechanism provided by the 802.11 standard by which WiFi clients proactively search for access points (APs) in their vicinity. To do so, a client sends out a probe request, in response to which all APs that hear the request send a probe response. Prior works have reported severe degradation in performance of WiFi networks due to excessive AS. In practice, a client triggers AS due to many causes, for example, when the screen of a smartphone turns on, or on the loss of beacons from its AP. This work provides an automated, client and AP agnostic, sniffer-based mechanism to diagnose the causes of AS. We study many existing WiFi driver implementations and user space applications to arrive at the main causes of AS. We propose mechanisms to infer the true cause of AS from logs collected by a WiFi sniffer. We evaluate the efficacy of inference in a controlled manner in which we trigger AS by introducing the causes of AS. While the inference is fairly accurate with F - Score greater than 0.57 for most causes, 3/7 causes are detected with F - Score greater than 0.80. We use the proposed mechanisms to diagnose the causes of AS in three real-world WiFi datasets. Excessive AS is often caused due to underlying issues in the network, for example, inadequate coverage by APs, or bad client behavior. With our mechanism, we believe, WiFi network administrators will be better equipped to diagnose these issues.