Recently we have seen a spike in the number of DHCP addresses being taken by mobile devices, and we took alternative measures to avoid using all addresses in the scope.
As we notice the issue propagating, we knew it was not just an increase of traffic at one location. We looked into the issue and found Apple devices using a randomized media access control address (MAC address) when performing some Wi-Fi scans.
Every device that connects to a network has a unique identifying code called a MAC address, and it works in the same way that every person has a unique phone number. It is not only phones that use MAC addresses, but every network device has one. It is how networks manage communications between devices by using the address to deliver the right network packets to that device. (Wikipedia: MAC address).
The fear is that the MAC address can also track you, and some people think it is beneficial to hide it. Having a unique identifier on a network device enables that device to be associated with any Wi-Fi network within range, whether or not you connect to it.
If you are in an airport, there are many Wi-Fi networks in use. Every time you come within range of a wireless network, the network talks with your device. Part of that conversation contains your MAC address. The concern is that, in theory, your device could be tracked as you travel by cafes, restaurants, businesses, airports, train stations, and any other place with Wi-Fi.
To address being tracked, recent software updates allow users to replace the assigned MAC address with one chosen randomly. With this feature enabled, your device uses a different, random MAC address with each Wi-Fi network. The idea is to increase your privacy by making it harder to track you.
According to Apple:
“Wi-Fi MAC address randomization support is utilized on iPhone 5 or later. Apple has informed Wi-Fi manufacturers that iOS and iPadOS Wi-Fi scans use a randomized MAC address and that neither Apple nor manufacturers can predict these randomized MAC addresses.iOS 14, iPadOS 14, and watchOS 7 introduce a new Wi-Fi privacy feature: When an iPhone, iPad, iPod touch, or Apple Watch connects to a Wi-Fi network, it identifies itself with a unique (random) MAC address per network. This feature can be disabled either by the user or using a new option in the Wi-Fi payload.”
The issue for Network Administrators is that as devices travel between locations, or different access points within a wireless mesh network, is that some devices are receiving multiple IP address leases from DHCP. This can cause the scope o be fully used and therefore will not allow new devices to connect since there are no more IP addresses to assign.
Some organizations are fighting back and will not let devices access Wi-Fi unless MAC address randomization is disabled.
Another quick solution is to take measures to either utilize VLANs or expand your scope. We would also suggest decreasing the TTL of your DHCP scope from days to hours
Apple has responded that Wi-Fi scans that happen while trying to connect to a preferred Wi-Fi network aren’t randomized.” I’m afraid I have to disagree as we do not see that behavior on many different networks. On some wireless mesh networks, the devices seem to be randomizing
If you would like help reviewing your customer experience, call Advanced Systems Solutions Inc, and we will help you ensure that your organization’s services and solutions are performing as expected.
Disclaimer: The above information is not intended as technical advice. Additional facts or future developments may affect subjects contained herein. Seek the advice of an IT Professional before acting or relying upon any information in this communiqué.
