Today Wi-Fi is everywhere and is one of the most widely used wireless networking protocols. Wi-Fi devices extend the network boundaries exposing also the network to anyone who is nearby. Reconnaissance is the first and one of the most important phases any attacker will perform. This phase defines the attack surface and the potential targets. This talk will present an overview of IEEE 802.11 reconnaissance based on management frames, showing the internals and how to perform passive & active scan using protocols such as Wi-Fi Simple Configuration, Wi-Fi Direct, Apple AirDrop/AirPlay, Cisco Compatible eXtensions among others. There is a lot of information from devices with Wi-Fi support that can be obtained and it's in the air for anyone to grab. Even devices connected to secure networks can expose information of the network or the device itself. During the presentation I will show how to use WIG tool to perform information gathering of Wi-Fi devices to get more than a MAC address to identify them. Also I will show some examples of how it is possible to reverse engineering this proprietary protocols