Opening raw sockets in Linux is a fun way to bang out your own IP, ARP, and ICMP packets for experimenting. I remember the joys of packet spoofing/flooding in college. I think with WiFi you're limited to the AP you're attached to?<p>It'd be a fun hack to read and inject raw wifi or LTE frames to get a count of radios within range, when they transmit and other details of the low level protocols. It looks like with SDR, folks are able to get better access to the physical layer.<p><a href="https://www.crowdsupply.com/lime-micro/limesdr-mini/updates/wi-fi-analysis-with-gr-802-11-and-wireshark" rel="nofollow">https://www.crowdsupply.com/lime-micro/limesdr-mini/updates/...</a>