Yep, you&#x27;re right. An 802.11 client broadcasts the MAC address in every frame in plaintext, so a more straightforward approach would be to use `airodump-ng` to list the cams. The innocent bystander practical &amp; legal concerns were probably the reason author did it this way.