# Reconnaissance

> Guides on passive scanning, WPS discovery, and frame analysis

- **URL:** https://hackindex.io/platforms/wireless/reconnaissance
- **Platform:** [Wireless](https://hackindex.io/platforms/wireless.md)
- **Published:** 2026-03-17
- **Updated:** 2026-03-29

## What this phase covers

Reconnaissance is passive. Nothing is transmitted except what is strictly necessary to listen. The goal is to build a complete picture of every access point in range, their encryption types, their clients, and which ones have WPS enabled before deciding where to focus.

Start with [airodump-ng](https://hackindex.io/platforms/wireless/reconnaissance/passive-scanning-with-airodump-ng) for a quick overview of all visible APs. Use [Kismet](https://hackindex.io/platforms/wireless/reconnaissance/passive-scanning-with-kismet) for longer surveys or when you need to run two adapters on different bands simultaneously without hopping gaps. Run [wash](https://hackindex.io/platforms/wireless/reconnaissance/wps-network-discovery-with-wash) against everything to flag WPS-enabled APs before moving to vulnerability discovery. Use [Wireshark and tshark](https://hackindex.io/platforms/wireless/reconnaissance/80211-frame-analysis-with-wireshark-and-tshark) to inspect individual frames when the high-level view from airodump-ng is not enough detail.

## What to note before moving on

Before leaving reconnaissance you should have: a list of all in-scope BSSIDs with their SSID, channel, encryption type, and AUTH column value; a list of WPS-enabled APs with lock status; and at least one client MAC per AP you intend to target. Any AP showing **OPN** in the ENC column is an immediate exploitation target ,  no further phases needed before capturing traffic. Any AP showing **WEP** is a priority target. Any AP showing **MGT** in AUTH is an enterprise network requiring a different attack path than PSK cracking.

## Flows into

[Enumeration](https://hackindex.io/platforms/wireless/enumeration) drills deeper into individual APs ,  MFP status, exact authentication suites, and PMKID capture. [Vulnerability discovery](https://hackindex.io/platforms/wireless/vulnerability-discovery) confirms which findings are exploitable. If you already have enough information to identify a clear target, you can move directly from reconnaissance to vulnerability discovery without a full enumeration pass.

## Guides

- [802.11 Frame Analysis with Wireshark and tshark](https://hackindex.io/platforms/wireless/reconnaissance/80211-frame-analysis-with-wireshark-and-tshark.md): Capture and dissect 802.11 management, control, and data frames using Wireshark and tshark to identify wireless network structure and connected clients.
- [Hidden SSID Discovery](https://hackindex.io/platforms/wireless/reconnaissance/hidden-ssid-discovery.md): Techniques for discovering concealed wireless networks by capturing probe requests, analyzing beacon frames, and forcing client deauthentication to reveal hidden SSIDs.
- [Passive Wireless Scanning with airodump-ng](https://hackindex.io/platforms/wireless/reconnaissance/passive-scanning-with-airodump-ng.md): Capture 802.11 frames passively using airodump-ng to enumerate SSIDs, BSSIDs, clients, channels, and encryption types without transmitting packets.
- [Passive Wireless Scanning with Kismet](https://hackindex.io/platforms/wireless/reconnaissance/passive-scanning-with-kismet.md): Discover and fingerprint wireless networks passively using Kismet to capture beacon frames, probe requests, and device metadata without transmitting packets.
- [WPS Network Discovery with wash](https://hackindex.io/platforms/wireless/reconnaissance/wps-network-discovery-with-wash.md): Identifies WPS-enabled access points using wash, covering scan syntax, output interpretation, and filtering locked/unlocked networks for PIN-based attack assessment.