In any residential building, there is a multitude of WPA2-protected wireless access points.

Yesterday I was at a friend's and attempted to launch `aircrack-ng` against their AP (with permission). I was assured that there is a linux laptop currently connected. However, I was unable to acquire the device's MAC, to pass to `aircrack-ng`.

**I would like to acquire a list of all wireless devices inbound, with their respective MAC and IP. If this is possible. I do not have the WPA2 password.**

I know that the first step is to put my network card in [monitor mode](http://en.wikipedia.org/wiki/Monitor_mode).

```
# airmon-ng <start|stop> <interface> [channel] or airmon-ng <check|check kill> 
sudo airmon-ng start wlan0 2

```

As a second step, I attempted `iwlist scan`. However, this returned only a list of AP-s, that is, devices in Master mode.

*Is there some communication between a connected device and the respective AP if no services are running, just to keep the connection alive? How do I monitor this traffic?*

Can I use something line `tcpdump wlan0` to do this? If yes, how can I get the MAC data out of the packets?