Kismet...to de-cloak a hidden SSID, and wait for a client to associate... http://www.kismetwireless.net/documentation.shtml "Kismet identifies networks by passively collecting packets and detecting networks, which allows it to detect (and given time, expose the names of ) hidden networks and the presence of non-beaconing networks via data traffic."
