[whichfawkes]

They can't query it, they have to be listening when it broadcasts.

[worldsayshi]

Yeah ok I understand that it doesn't have a memory. But you can still sort of "query" the current state of a device that is always broadcasting, like a flow or speed sensor.

[regularfry]

The router's probably pinging beacon frames out several times a second anyway. There's a lot of 2.4GHz traffic a passive listener could use.