The legally allowable band for WiFI in the US covers channels 1-11. Europe goes to 13, Japan to 14. I suspect that most tools use the WiFi driver of the machine and only scan for the channels it is limited to. Do you know of any tools that scan higher channels by default? With configuration?
For some examples of things that will detect these:
- A modified firmware Linksys with extra channels opened up and run in analyzer mode.
- A radio spectrum analyzer.
- A USRP (kind of like above, but we can decode and talk back).
EDIT AND REDIRECT: I know how to perform this attack and detect a rogue access point that is out-of-band, whether it be WiFi or any other continuously operating transmission device. The point of this question is to discern whether most organizations would pick this attack up or are even aware of it in cases where somebody has placed an access point without company knowledge. I am aware of FCC communication rules and how they prohibit this. That said, it is the detection of such a device that is of concern, and that does not rely on illegal transmission.
Many security reviews include scanning for unauthorized WiFi devices, including the PCI DSS standards (11.1). What I seek are answers related to whether this attack vector is commonly accounted for.