diff --git a/tag_fw/main.c b/tag_fw/main.c
index 920d94d6..86d989e7 100644
--- a/tag_fw/main.c
+++ b/tag_fw/main.c
@@ -26,7 +26,7 @@ uint8_t showChannelSelect() {
     showScanningWindow();
     for (uint8_t i = 0; i < 8; i++) {
         for (uint8_t c = 11; c < 27; c++) {
-            if (probeChannel(c)) {
+            if (detectAP(c)) {
                 if (mLastLqi > result[c - 11]) result[c - 11] = mLastLqi;
                 pr("Channel: %d - LQI: %d RSSI %d\n", c, mLastLqi, mLastRSSI);
             }
diff --git a/tag_fw/powermgt.h b/tag_fw/powermgt.h
index 1b55562a..65889c0c 100644
--- a/tag_fw/powermgt.h
+++ b/tag_fw/powermgt.h
@@ -20,6 +20,9 @@
 #define POWER_SAVING_SMOOTHING 8      // How many samples we should use to smooth the data request interval
 #define MINIMUM_INTERVAL 45           // IMPORTANT: Minimum interval for check-in; this determines overal battery life!
 
+#define MAXIMUM_PING_ATTEMPTS 20      // How many attempts to discover an AP the tag should do
+#define PING_REPLY_WINDOW 2UL
+
 
 extern void initAfterWake();
 extern void doSleep(uint32_t __xdata t);
diff --git a/tag_fw/syncedproto.c b/tag_fw/syncedproto.c
index 371c3f0f..5e6d72d3 100644
--- a/tag_fw/syncedproto.c
+++ b/tag_fw/syncedproto.c
@@ -28,7 +28,7 @@ bool __xdata dataPending = true;
 uint8_t __xdata blockXferBuffer[BLOCK_XFER_BUFFER_SIZE] = {0};
 struct blockRequest __xdata curBlock = {0};
 struct AvailDataInfo __xdata curDataInfo = {0};
-uint16_t __xdata dataRemaining = 0;                             // since the targeted solum tags don't have more than 64k progmem, this is fine. 
+uint16_t __xdata dataRemaining = 0;  // since the targeted solum tags don't have more than 64k progmem, this is fine.
 bool __xdata curXferComplete = false;
 bool __xdata requestPartialBlock = false;
 
@@ -70,6 +70,17 @@ uint8_t __xdata getPacketType(void *__xdata buffer) {
     }
     return 0;
 }
+bool pktIsUnicast(void *__xdata buffer) {
+    struct MacFcs *__xdata fcs = buffer;
+    if ((fcs->frameType == 1) && (fcs->destAddrType == 2) && (fcs->srcAddrType == 3) && (fcs->panIdCompressed == 0)) {
+        return false;
+    } else if ((fcs->frameType == 1) && (fcs->destAddrType == 3) && (fcs->srcAddrType == 3) && (fcs->panIdCompressed == 1)) {
+        // normal frame
+        return true;
+    }
+    // unknown type...
+    return false;
+}
 void dump(uint8_t *__xdata a, uint16_t __xdata l) {
     pr("\n        ");
 #define ROWS 16
@@ -130,14 +141,46 @@ void killRadio() {
     RADIO_command = 0xC5;
     CFGPAGE = cfgPg;
 }
-bool probeChannel(uint8_t channel) {
+void sendPing() {
+    struct MacFrameBcast __xdata *txframe = (struct MacFrameBcast *)(outBuffer + 1);
+    memset(outBuffer, 0, sizeof(struct MacFrameBcast) + 2 + 4);
+    outBuffer[0] = sizeof(struct MacFrameBcast) + 1 + 2;
+    outBuffer[sizeof(struct MacFrameBcast) + 1] = PKT_PING;
+    memcpy(txframe->src, mSelfMac, 8);
+    txframe->fcs.frameType = 1;
+    txframe->fcs.ackReqd = 1;
+    txframe->fcs.destAddrType = 2;
+    txframe->fcs.srcAddrType = 3;
+    txframe->seq = seq++;
+    txframe->dstPan = 0xFFFF;
+    txframe->dstAddr = 0xFFFF;
+    txframe->srcPan = PROTO_PAN_ID;
+    commsTxNoCpy(outBuffer);
+}
+uint8_t detectAP(uint8_t channel) {
+    uint32_t __xdata t;
     radioRxEnable(false, true);
     radioRxFlush();
     radioSetChannel(channel);
     radioRxEnable(true, true);
-    getAvailDataInfo();
-    return(dataReqLastAttempt != DATA_REQ_MAX_ATTEMPTS);
-
+    for (uint8_t c = 1; c <= MAXIMUM_PING_ATTEMPTS; c++) {
+        sendPing();
+        t = timerGet() + (TIMER_TICKS_PER_MS * PING_REPLY_WINDOW);
+        while (timerGet() < t) {
+            int8_t __xdata ret = commsRxUnencrypted(inBuffer);
+            if (ret > 1) {
+                if (getPacketType(inBuffer) == PKT_PONG) {
+                    if (pktIsUnicast(inBuffer)) {
+                        struct MacFrameNormal *__xdata f = (struct MacFrameNormal *)inBuffer;
+                        memcpy(APmac, f->src, 8);
+                        APsrcPan = f->pan;
+                        return c;
+                    }
+                }
+            }
+        }
+    }
+    return 0;
 }
 
 // data xfer stuff
@@ -160,7 +203,6 @@ void sendAvailDataReq() {
     availreq->hwType = HW_TYPE;
     availreq->wakeupReason = wakeUpReason;
 
-
     addCRC(availreq, sizeof(struct AvailDataReq));
     commsTxNoCpy(outBuffer);
 }
@@ -177,8 +219,6 @@ struct AvailDataInfo *__xdata getAvailDataInfo() {
                         struct MacFrameNormal *__xdata f = (struct MacFrameNormal *)inBuffer;
                         memcpy(APmac, f->src, 8);
                         APsrcPan = f->pan;
-                        // pr("RSSI: %d\n", commsGetLastPacketRSSI());
-                        // pr("LQI: %d\n", commsGetLastPacketLQI());
                         dataReqLastAttempt = c;
                         return (struct AvailDataInfo *)(inBuffer + sizeof(struct MacFrameNormal) + 1);
                     }
diff --git a/tag_fw/syncedproto.h b/tag_fw/syncedproto.h
index 583296dc..a78a2b94 100644
--- a/tag_fw/syncedproto.h
+++ b/tag_fw/syncedproto.h
@@ -16,5 +16,6 @@ extern struct AvailDataInfo *__xdata getAvailDataInfo();
 extern bool doDataDownload(struct AvailDataInfo *__xdata avail);
 extern void initializeProto();
 extern struct AvailDataInfo *__xdata getAvailDataInfo();
-bool probeChannel(uint8_t channel);
+uint8_t detectAP(uint8_t channel);
+
 #endif
\ No newline at end of file