Apple iPhone KO's Cisco network at Duke

[ Read update: iPhone off the hook ]

On Friday (the 13th), Kevin Miller, Duke's assistant director of communications infrastructure, posted a plea for help on the EDUCAUSE wireless issues listserv:

Subject: Misbehaving iPhones?

For the last week or so, we have seen some unusual problems with our autonomous (cisco) APs. In particular, for short periods of time (~5-10 minutes), a large number of them would appear "down" in our monitoring system.

In these instances we began capturing traffic, and until just now I didn't realize what I was looking at. ... Basically we'd see thousands of ARPs like this.

What I just discovered this evening is that [this address] is registered to Apple. The first MAC address above wasn't registered in our system, but the second was .... someone's iPhone.

I am guessing that the iPhone has traveled from an off campus location (e.g. home network) to ours, and is trying to ARP for the gateway. The home location may use the same SSID as we do for simplicity of configuration.

However in the process it's flooding our wireless network with thousands of ARPs.. in one case, nearly 11,500 ARPs per second!

Anyone else seeing this?

According to Bill Cannon, a Duke technology spokesman, there are between 100-150 iPhones on campus now. However, a single iPhone is powerful enough to cause the problem. When regular classes resume this fall, students will be bringing many more into town. "The more iPhones that are around, the more they could be knocking on the door for access".

As of this writing, the university is in contact with both Apple and Cisco but a solution to the problem still hasn't been found. Meanwhile, network administrators at other campuses are keeping a close eye on the situation in case it becomes more widespread. LSU reportedly shut off access to its open wireless network on Monday as a preventative measure.