Final answer:
In passive scanning, a client locates a wireless LAN by listening for beacon frames broadcasted by access points, without actively broadcasting requests or pinging devices.
Step-by-step explanation:
When a client is performing passive scanning to locate a wireless LAN (WLAN), it listens for beacon frames that are broadcasted by nearby access points. These beacon frames contain information about the network, such as its name (SSID) and other parameters necessary for communication. Unlike active scanning, where the client sends probe requests to which access points respond with probe responses, passive scanning is a listening-only operation. The client does not broadcast any requests or actively ping devices; it simply waits to hear the regular beacons sent out by all access points in its range.