Does the following command support promiscious mode, where all MAC addresses are listened to and counted?
calibrator wlan0 wl18xx_plt start_rx <source_address> <destination_address>
This is from the http://processors.wiki.ti.com/index.php/WL18xx_RX_Testing page.