| Passive scan | Client dwells on each channel (~100+ ms) listening for beacons. | Mandatory on channels flagged no-active-scan (DFS, unknown regulatory). Slow: full 5 GHz passive sweep can exceed 2-3 s - roam scan budgeting matters. |
| Active scan | Client sends Probe Request (wildcard or directed SSID), waits ProbeTimer (~10-30 ms) per channel for Probe Responses. | Fast but leaks client presence (probes reveal MAC - hence randomization). Hidden SSID only answers directed probes. |
| 6 GHz scan rules | Legacy-style blind probing effectively eliminated: 20 MHz-only probes restricted; discovery relies on PSC + in-band FILS Discovery/UPR + out-of-band RNR. | Design consequence: clients discover 6 GHz FAST only if 2.4/5 GHz beacons carry correct RNR - misconfigured co-located sets = "phone never sees 6 GHz". |
| PSC channels | Preferred Scanning Channels: every 4th 20 MHz channel - 5, 21, 37, 53, 69, 85, 101, 117, 133, 149, 165, 181, 197, 213, 229. | Clients scan only PSCs on 6 GHz. Best practice: put the 6 GHz BSS primary on a PSC (80 MHz-centered plans do this naturally). |
| FILS Discovery frames | AP broadcasts compact FILS Discovery frames between beacons (max gap 20 TU) on 6 GHz. | Alternative to Unsolicited Probe Responses; lower airtime. |
| Unsolicited Probe Response (UPR) | AP broadcasts full Probe Responses every ≤20 TU on 6 GHz. | Chattier alternative to FILS Discovery - one or the other is required in-band. |
| RNR (out-of-band) | Reduced Neighbor Report (IE 201) in 2.4/5 GHz beacons advertises the co-located 6 GHz BSS: op class, channel, short-SSID, BSSID, PSD. | The primary real-world 6 GHz discovery path. Also carries multiple-BSSID/co-hosted info. |
| Multiple BSSID (6 GHz) | On 6 GHz, co-located SSIDs must share one beacon via Multiple BSSID element (transmitted + nontransmitted profiles). | Client bugs parsing MBSSID profiles = "SSID visible on 5 GHz only" tickets. |