hidden ssid - broadcast beacons - Question

[Stefan Bauer]

Dear Users,

this is probably a frequently asked question, but i did not find a
suitable answer.

years ago, i setup a few accesspoints and specify the option to hide
the network-id (ssid) of my networks. most of the clients are
thinkpads with wpa_supplicant. month ago i noticed, that this
method only omits sending the essid's in the broadcast frames.

there are a few other frames with includes the ssid's like:

BEACONs
PROBE Requests
PROBE Responses
ASSOCIATION Requests
REASSOCIATION Requests

my question is now how to read the hidden id out of the other frames?

are there any common tools available for unix to grab such packages
and read the ssid in plaintext?

i found aircrack-ng for cracking/breaking into networks, but thats not
what i want. i just want to read the essid's in plaintext and
understand how this works a bit more in detail.

thanks in advance

best regards

stefan