In any residential building, there is a multitude of WPA2-protected wireless access points.
Yesterday I was at a friend's and attempted to launch
aircrack-ng against their AP (with permission). I was assured that there is a linux laptop currently connected. However, I was unable to acquire the device's MAC, to pass to aircrach-ng.
I would like to acquire a list of all wireless devices inbound, with their respective MAC and IP. If this is possible. I do not have the WPA2 password.
I know that the first step is to put my network card in monitor mode.
# airmon-ng <start|stop> <interface> [channel] or airmon-ng <check|check kill> sudo airmon-ng start wlan0 2
As a second step, I attempted
iwlist scan. However, this returned only a list of AP-s, that is, as far as I understand, devices in Master mode.
Is there some communication between a connected device and the respective AP if no services are running, just to keep the connection alive? How do I monitor this traffic?
Can I use something line
tcpdump wlan0 to do this? If yes, how can I get the MAC data out of the packets?