Question: I would like to know if Android devices make active or passive scan when looking for the AP to connect. I've already made a test using Wireshark and wifi sniffer and it seems that while an iPhone sends Probe Request frames to discover available APs (active scan), my Android device sometimes sends Probe Request frame, but most of the times it does not send Probe Request frames at all, but waits for the AP to send a Beacon frame (passive scan).

I've been looking for some official info/documentation concerning this topic, but haven't found anything useful yet. I would be very grateful if someone could provide me with the answer to this question.

Answer: 
The only "official" explanation I found is in [this comment](https://android.googlesource.com/platform/frameworks/base/+/a5ec95cdb1a7d2024249277dff1f99d0046c9b56) (dated July 2009) in the Git repositories on android:

> 
> wifi: **WifiManager.startScan() will now do passive scans by default**.
> 
> 
> Active scans will only happen if an hidden AP is in use, or if the new method
> *WifiManager.startScanActive()* is called.
> 
> 
> 

The existence of an hidden function to start an active scan (reported [here](https://github.com/mozilla/MozStumbler/issues/40)) suggests that the normal scanning function is indeed passive. This is to be taken with a grain of salt, though, as the Android documentation doesn't explicitly tell if the function *WifiManager.startScan()* is passive or not.

Also related: this two posts on SO ([post 1](https://stackoverflow.com/questions/3439811/do-android-devices-scan-actively-for-wifi-networks?rq=1), [post 2](https://stackoverflow.com/questions/24670963/how-to-active-scan-wifi-in-android)) report that the scanning activity is passive (post 1) and that since android 4.3 it not even possible to call the active scan method (post 2) - but there is no link to official sources.
I have been searching for the official document for an exact answer too. But I couldn't find any. Hence I'm writing this base my own assumption. 
I believe a client device(mobile in this case) does both the active and passive scan.
My reasons are as below:

1. When a mobile activates the WiFi interface, it needs to scan for the beacons by nearby AP so that the available SSIDs will be listed for connection. This is a passive scanning mode.
2. A mobile which has been connected to several SSIDs before will bust the probe request frames(with all the SSIDs) to nearby AP and if the SSID match, the AP will respond to the probe request and the connection/authentication process will begin. This is an active scanning mode.
3. Special case for the AP with hidden SSID. When the user manually connecting to the hidden SSID, the mobile device will generate a probe request and broadcast it to the nearby AP. When the SSID matched any of the AP, it will follow by connection/authentication process. This is an active scanning mode too.