well if you change the password, he can reset and set it back to his password...correct? either way, you cannot sniff out a router's password, because it is not sent out anywhere....
i suppose you *could* sniff the packets from when your friend logs onto the router, but that would be hell to even bother with...seeing as how the packets aren't in plain english and are beyond my networking knowledge.
there are default passwords sometimes hardcoded in the BIOS, you may wanna google "default passwords" (followed by your router name/model). otherwise you'd get stuck with some bruteforce/dictionary attack.
A_T
