Wi-Fi Client MAC Address Scanning

Question

In Linux, I would like to know if it's possible to get the MAC address of WiFi clients in close proximity, not configured for Ad-Hoc or as Access Points. For example, a mobile phone that just has Wi-Fi turned on but that may not be connected to anything.

Of course, I can use "iwlist rausb0 scanning" to get nearby access points and then parse the output for the MAC address of each. However, can I also get the addresses of nearby Wi-Fi client devices using another type of software?

Answer 1

You can use airodump-ng which is part of the aircrack-ng suite.

airodump lists all access points and wireless devices in your proximity by default, if you only want to list wireless devices that are associated with a (known) access point append the -a option.

Read up on airodump-ng on the aircrack-ng website.

Answer 2

Yes, by listening airflow or creating fake AP.

How and witch software, should be the question. I think back track should have by default software you are looking for.