Wi-Fi client devices can seek a wireless network to connect to through active or passive scanning for ‘beacons’ broadcast by access points. Smartphones typically use active scanning, which means they switch on their wireless radio for a brief period to send a probe request and receive information about networks within range. The operating systems of wireless devices can include a preferred network list (PNL), which incorporates some of the SSIDs of Wi-Fi networks the device has previously successfully connected to, and some devices will include this information in their probe requests.

via Wi-Fi sniffing lets researchers take social snapshots of crowds – Wi-Fi, security, mobility, smartphones – Security – Techworld.