A hidden or non-broadcast WiFi Access Point remains always hidden i.e. it always sets SSID to
null in beacon frames it sends. However once you manually add its SSID to a supplicant, it depends on the latter whether it explicitly scans the former in future or not. Android's WiFi client is
wpa_supplicant, the same is most commonly used on other Linux-based OSes. From
wpa_supplicnat configuration manpage:
SSID scan technique; 0 (default) or 1. Technique 0 scans for the SSID using a broadcast Probe Request frame while 1 uses a directed Probe Request frame. Access points that cloak themselves by not broadcasting their SSID require technique 1
scan_ssid=1 is usually the default behavior on most OSes. Also Windows built-in supplicant can "connect even if the network is not broadcasting".
In the future if Android client does not send a direct probe request for a specific hidden SSID and instead sends a broadcast probe, will it be unable to detect the network?
Yes definitely. But scanning hidden networks is default setting up to Android 8. In Android 9 a new configuration was added to allow explicitly setting the behavior:
My question is if the network is still considered a hidden network on
In Android whole configuration is not added to
wpa_supplicant.conf file but retained by Android framework. Since Android 8 it's stored in
WifiConfigStore.xml files located under
/data/misc* directories. According to user selection,
scan_ssid=[0|1] - along with other configurations - is passed to
wpa_supplicant process over HIDL - an Android specific IPC - or possibly over global
To summarize, yes Android (by default or optionally) sends direct probe requests to saved non-broadcast WiFi networks.