Mystery Wifi Leases - Apple Private Wifi Mac

jpvonhemel

Just FYI. The past few days, I have been trying to figure out what some of the leased hosts were on my LAN. I typically put a DHCP reservation for my devices to keep my LAN in order and OCD in check. I kept trying to figure out what these were, and noticed they were traveling around to different APs. The mac addresses also would not register a business name in an OUI look, which sucks and does not help.

I finally figured out that Apple iPad and iPhone has a Privacy Wifi Address feature that changes the mac address to one that is not in the OUI lookup and hence gets a leased address from the DCHP server.

johnpoz

@jpvonhemel you can turn that off on the device.. Changing their mac makes is difficult to create firewall rules based on IPs that is for sure. I have it turned off on all my apple devices for my local wifi networks..

jpvonhemel

@johnpoz Thanks. I did turn them off on the apple device. It looks like it is just an alternative mac and not a random spoofed one.

johnpoz

@jpvonhemel its a random one - it will change as you change wifi networks.. And can change on its own on new connection.. Not a Fan to be honest that is for sure.

https://support.apple.com/en-us/HT211227
Use private Wi-Fi addresses on iPhone, iPad, iPod touch, and Apple Watch

The only good thing about it - is it is easy enough to turn off ;)

It should from my understanding use that same random mac on your network, unless you reset it or forget that network... But then there is always this "if your device hasn’t joined the network in 6 weeks, it uses a different private address the next time it connects to that network"

So if your device hasn't been on your network in a while, and it reconnects will use a different mac.. So yeah it can be problematic trying to create specific firewall rules for specific devices with such a "feature" ;)