NetSpot Passive vs. Active Scanning: Exact packet flow & BSSID targeting?

Ask About NetSpot
1

I’m working on a site survey deployment plan and need to map out the exact underlying mechanics of how NetSpot handles its scans. The marketing docs are a bit too high-level, so I’m looking for the actual protocol-level behavior.

Can anyone break down the exact communication flow, or better yet, share a sequence diagram/pcap logic for:

  1. Passive Scan: What is the client actually doing? Just listening for Beacons?

  2. Active Scan: What specific frames are flying between the client (PC running NetSpot), the AP, and any other peers? Are we talking Probe Requests/Responses, Null Data frames, or actual association attempts?

In a high-density environment where a single SSID is broadcast across dozens of APs, can NetSpot isolate measurements to a single radio? Specifically:

  • Can I force it to scan only a specific BSSID and ignore the rest of the chatter on that SSID?

  • Is it possible to lock the measurement and analysis strictly to one designated AP’s BSSID during a survey?

Appreciate any insights from anyone who has looked at this through Wireshark or dealt with their enterprise support!

2

I can’t provide any official documentation or internal protocol diagrams. But I can explain how it works under the hood:

  • Passive scanning relies entirely on beacon frames that access points broadcast at regular beacon intervals. The software just listens without transmitting.

  • Active scanning actually connects to the nearest access point broadcasting your specified SSID and transfers a small amount of test data between our server and your client device to measure throughput. The resulting metrics will be assigned directly to the specific BSSID to which the client was physically connected at that moment. If you want to see the total measurement results for that entire network, you can simply select all access points sharing that same SSID in the filtering panel.

3

@NodeRunnerY Ah, got it. So active scanning is basically doing a mini speed/ping test over the association, rather than just blasting probe requests. That makes sense why it binds to one BSSID at a time. Thanks for clarifying!

4

@NodeRunnerY Okay, that answers my question about targeting. So, if I want to get an accurate benchmark of the entire network under that SSID, I basically need to make sure that all BSSIDs sharing that SSID are enabled and selected during the scan/analysis, right?

5

Yes, that’s exactly right. To get the full picture of your network’s performance and see the aggregated results, you need to ensure all BSSIDs for that specific SSID are active and selected in the project. If you exclude some BSSIDs, you’ll miss the data from the APs the client might automatically roam to during the test.