Smartphone Disrupts Windows Network

The Mystery

One day I installed 2 new Windows 7 Professional PCs on a network with a 2003 Server domain. Everything went smoothly, but 2 weeks later I was called back to investigate why the 2 PCs could no longer see the server or reach the internet. Booting the PC also took 10 minutes or longer. After debugging for some time, I was stumped and finally called Microsoft support. After hours of debugging, the Microsoft technician had uncovered some interesting facts.

As background, there is a table in Windows that holds the IP address and MAC address of network devices. This is known as the ARP - Address Resolution Protocol - table. At a command prompt, he issued the "arp -a" command which showed all ARP table entries. The entry for the server at IP address showed a certain MAC address. However, this was NOT the MAC address of the server. After issuing the "arp -d" command to delete the current ARP table and also the "ipconfig /flusdns" command to flush the DNS cache, the Windows 7 PCs operated correctly. When he issued the "arp -a" command, the correct MAC address for the server was listed.

ARP Table Example

The Microsoft technician suggested that the router was probably bad. I replaced the router, but the problem occurred again in a week on a Windows XP and 7 PC. I replaced the network switch and the problem occurred again a week later. Always, deleting the ARP table would temporarily fix the problem.

The Revelation

At 4:30 one morning, I could not sleep and pondered the problem. I wondered if the bad MAC address listed in the ARP table belonged to a device on the network. I went to a MAC address lookup website and found it belonged to a Samsung device. Aha! It was probably a Samsung smartphone. The next day I asked the technical go-to at the customer to look over all Samsung smartphones for that specific MAC address. He found one of the employees had a Samsung Android phone with that MAC address and it was set to connect to their network through Wi-Fi. Bingo!

They asked him to turn off Wi-Fi on his smartphone before he enters the building. The problem has gone away. Occasionally, he will forget to turn off Wi-Fi before he enters. Screams of protest fill the air. He turns off Wi-Fi, they flush their ARP tables, and peace returns.

More by this Author


Kiddo Zerglin profile image

Kiddo Zerglin 3 years ago from Michigan, USA

Ban that MAC address from the server. Problem solved (permanently).

Emperor Crusher profile image

Emperor Crusher 3 years ago from Wichita, KS, USA Author

Kiddo, thank you for the suggestion. Server 2003 does not have a mechanism to block by MAC address. Fortunately, Server 2003 will soon be a thing of the past and the new servers do have the ability to block by MAC address. My hope is that this hub will help others with the same problem come to realize what is happening sooner and perhaps they have a newer server that can block by MAC address.

Kiddo Zerglin profile image

Kiddo Zerglin 3 years ago from Michigan, USA

You can block the MAC address via your network switch/router if it supports iptables.

    Sign in or sign up and post using a HubPages Network account.

    0 of 8192 characters used
    Post Comment

    No HTML is allowed in comments, but URLs will be hyperlinked. Comments are not for promoting your articles or other sites.

    Click to Rate This Article