How are they getting the MAC address of my WiFi interface? I thought that an unassociated WiFi station would listen for beacons of access points (scanning). When an upper layer sees an access point that policy says the device should connect to, it will try to associate with it. Until then, what packets is my device sending out?
If I were running my own access point, I would be transmitting beacons. It my device was configured to connect to any open acces point, then it would connect when it found one.
In the absence of these two device policies, what would be causing my device to transmit packets?