I saw a fun demo where you can cap probe requests to get SSID's from previously connected AP's. Then use that data to look up the geolocation via a site like https://wigle.net.
Here are a few examples using tshark https://github.com/xme/hoover or http://www.sensepost.com/blog/7557.html
I'm not seeing an easy way to do this with tcpdump or airmon-ng
Idea's?