A Probe Request frame is transmitted by a station (STA) during active scanning to discover nearby wireless networks. When the SSID information element within this frame has a length of zero, it is referred to as a "null SSID" or "wildcard" probe. This specific type of Probe Request is a general broadcast inquiry, asking any Access Point (AP) that receives it to reply with a Probe Response. This mechanism allows the client STA to efficiently build a comprehensive list of all available Basic Service Sets (BSSs) within its range, rather than searching for a single, pre-configured network.

A. Promiscuous mode is a passive listening configuration for network analysis; it does not dictate the content of frames the STA actively transmits.

B. A null SSID probe is a standard discovery method in infrastructure mode and is not an exclusive indicator of a STA operating in Ad-Hoc (IBSS) mode.

C. A disabled WLAN adapter is incapable of transmitting any frames, including the Probe Request frame that was observed.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016), IEEE Standard for Information Technology—Telecommunications and information exchange between systems Local and metropolitan area networks—Specific requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.

Section 11.1.3.2.1, "Active scanning": "To find any AP, the STA transmits a Probe Request frame with the SSID field in the SSID element set to the broadcast SSID (i.e., the length of the SSID field is 0)."

Section 9.4.2.2, "Probe Request frame format": "The SSID element indicates the desired SSID. A STA may set the SSID element to the broadcast SSID (the SSID element with the SSID field of length 0) to request a response from any AP."

2. Carnegie Mellon University, School of Computer Science Courseware. "15-441: Computer Networks, Lecture 23: Wireless," by Srinivasan Seshan.

Slide 21, "Joining a Network: Scanning": The slide on Active Scanning describes the process: "Probe request sent on each channel... SSID = broadcast... APs send probe response...". This confirms that a broadcast SSID (null SSID) is used to discover available APs.