Every wireless device periodically broadcasts its own MAC address when scanning for or connecting to a network, and routers or dedicated probes can passively capture these signals.