My generic Android phone, like many others, has a different random MAC every time I switch WiFi on and off since the manufacturer didn't write one to the EEPROM. A lot of people find this to be a bug, but maybe it's an "unintentional security feature"... it certainly is quite useful when using limited free WiFi hotspots.
There seems to have been a surprising amount of attention paid to passive wifi tracking recently. We did a hack weekend project on this last year (<a href="http://matthewmacleod.co.uk/blog/passive-wifi-tracking.html" rel="nofollow">http://matthewmacleod.co.uk/blog/passive-wifi-tracking.html</a> – though I never got to write it up properly) and I've had a number of people looking for more details.<p>This article's a pretty good approach. We used Kismet instead though – you can control it using a nice TCP interface, and have it spit out the hardware MAC addresses of any packets it sees.<p>Pretty interesting, but I'd never roll this out in a public place. Just seems a little creepy…
I wrote a similar script (via aircrack) at a recent hackathon to gather wifi nodes, and group them up by their access point (or if they weren't connected to one). The data dump was then transformed into json and fed into a neat little d3 chart.<p>The hardware was very minimal too, just an Arduino Yun with a cheap high-gain antenna.<p>It was a fun project to hack on, but it definitely raised some eyebrows and made me rethink about some of the privacy concerns around this.
It's interesting the attention that passive wifi tracking is receiving. Another person and I actually wrote software a client to install on raspberry pi's and a server to store all the results. We deployed this on our college campus and were shocked by how well we could track devices [1]. This is a serious problem given a large scale of sensors.<p>[1] We only stored a bcrypt hash of the mac address given the privacy concerns.