[omniglottal]

Active scanning (where the client sends the SSID of an AP it's trying to connect to) is ironically limited to just hidden AP SSIDs.