Detecting MAC addresses in a shared medium using WLAN/802.11 features

Question

Say you have 2 WiFi-enabled devices (e.g. 2 smartphones running a Linux-based OS) A and B, within range of each other, and within range of an access point of some WLAN.

Both of them have their Wi-Fi enabled, however B is not connected to the WLAN network (A is and has an IP address).

Is it possible for A to become aware of the existence of B?

Under these circumstances, B doesn't have an IP address assigned to it, so a 'ping sweep' across the range of IPs of the WLAN A is connected to is pointless.

However, since Wi-Fi is enabled, their PHY and MAC layers are operational.

• Is there some PHY/MAC layer feature/protocol in 802.11 which can be exploited so that one of the devices becomes aware of the MAC addresses surrounding it? E.g. some MAC-level challenge/response protocol, beacons of some sort?
• If A runs an application which listens on its wlan0 interface - e.g. built with libpcap or tcpdump - can it become aware of B by examining the captured frames?

Answer 1

For A to detect B, it has go into "monitor mode" and listen on every channel (there's no guarantee B is even on the same channel) for 802.11 headers. But doing so means A is no longer associated with the WLAN.

B might be sending out probes requests, but that also isn't guaranteed. Even if it is, you still have the problem of identifying B if you don't already know its MAC address.

Wireshark, for example, does what you are looking for.