I think you're right, however, sometimes there's no traffic between client and AP, and higher level application data is simply not available.

OTOH, I'm surprised (and happy) to see that my ubuntu is able to use the broadcom's reverse-engineered kernel driver + kismet to make passive sniffin'with very good results. This is something that even the windows driver is not able to do.