All you need is a MAC and a dev and you can sniff without sending packets. So I have been in some tight spots where I had to sniff a password or two off the wire, or sniff some packets off the wire undetected and based on the packets content do something. So I tried a few things and this is what worked.