A similar question was answered here for sniffing MAC addresses from clients connected to 802.11 wireless access points. My question is, is it possible to sniff MAC addresses from clients which are currently not connected an access point? For example, does an active WiFi on a smartphone or PC broadcast its MAC address when it is searching for access points, or is it only in receiving mode?
802.11 devices send probe requests to identify if a given network is nearby. Probe requests still contain standard MAC headers - which would contain destination and sender address fields. The destination address would be set to the broadcast address ("ff:ff:ff:ff:ff:ff") but yes in normal client operation you would expect the client to fill their own address into the sender address field.
Yes! As said by @hector, before connecting to the AP, Wi-Fi devices sends probe requests looking for APs that they "know" or to declare themselves to the APs around.
You will need a tool to sniff wireless packets (like
airodump-ng), a card with "monitor mode" and the rest is easy. You can find good tutorials for that using your favorite search engine.
Because of the OSI-model, the physical layer is usually not encrypted so you can get the MAC address and even more information. This makes MAC address filtering not really efficient as means of access restriction.