, isn't possible without the router password, even if you are in promiscuous mode, because the data packets are encrypted. The only solution (that i know of) is to use programs to try and match the MAC address to a manufacturer. Or get visual contact with the router. Or, in some cases (i.e. when the router is from an ISP that changes ssid to a custom one), looking at the ssid and searching the internet for the matching brand of the router.
is it possible to know the model and the brand by a sniff with wireshark in promiscious mode and a filter on wifi headers to create a fake setup page?