wireless networking - How to find the MAC addresses of an unsecure network, on Windows, using the easiest steps?

As I try to prove that an insecure network, even with MAC filtering feature, is a bad thing (link here) , I've tried to find out the easiest way to do so.

I'm trying to show that it's easy to enter such a network . I've already seen many links saying this, and that it's easy to do it.

Since Windows is still the most popular PC OS, I've tried to find answers about it. I know that linux is very popular for this task and that there is even a linux distro exactly for these type of security checks (called "backtrack" ), but I want to show that it is easy for everyone.

I also know that there are even tutorials for Windows (like this one) but i couldn't find any that involves a working , free solution .

What I know is that proving this would take 2 steps:

1. 
   

   find the MAC addresses of devices that are already connected to the insecure network.

   
   


2. 
   

   spoof the MAC address of one of them.

   
   

for #2 i've find some easy apps (like etherChange for windows, and MacMan for Android).

However, for #1 I couldn't find an easy, free solution on Windows.

Can anyone please help me with this?

Am I even in the right direction? Maybe I could do packets sniffing after spoofing the MAC address of the access point itself? If so, what should I search for there, and which tool is the easiest for this task?