Thanks! So, you're saying making an IMEI sniffer would not be easy? Seems like it'd be easier to get just the IMEI numbers from all phones in range than getting voice from just one.
As I said, the phones are not sending their IMEI around all the time, it's not like a MAC in a LAN. Just at specific points (which can be rare) in their interaction with the network they send it out over an encrypted channel.
Regards, Mad