Smartphone Disrupts Windows Network

One day I installed 2 new Windows 7 Professional PCs on a network with a 2003 Server domain. Everything went smoothly, but 2 weeks later I was called back to investigate why the 2 PCs could no longer see the server or reach the internet. Booting the PC also took 10 minutes or longer. After debugging for some time, I was stumped and finally called Microsoft support. After hours of debugging, the Microsoft technician had uncovered some interesting facts.

As background, there is a table in Windows that holds the IP address and MAC address of network devices. This is known as the ARP - Address Resolution Protocol - table. At a command prompt, he issued the "arp -a" command which showed all ARP table entries. The entry for the server at IP address 192.168.1.2 showed a certain MAC address. However, this was NOT the MAC address of the server. After issuing the "arp -d" command to delete the current ARP table and also the "ipconfig /flusdns" command to flush the DNS cache, the Windows 7 PCs operated correctly. When he issued the "arp -a" command, the correct MAC address for the server was listed.

The Microsoft technician suggested that the router was probably bad. I replaced the router, but the problem occurred again in a week on a Windows XP and 7 PC. I replaced the network switch and the problem occurred again a week later. Always, deleting the ARP table would temporarily fix the problem.

At 4:30 one morning, I could not sleep and pondered the problem. I wondered if the bad MAC address listed in the ARP table belonged to a device on the network. I went to a MAC address lookup website and found it belonged to a Samsung device. Aha! It was probably a Samsung smartphone. The next day I asked the technical go-to at the customer to look over all Samsung smartphones for that specific MAC address. He found one of the employees had a Samsung Android phone with that MAC address and it was set to connect to their network through Wi-Fi. Bingo!

They asked him to turn off Wi-Fi on his smartphone before he enters the building. The problem has gone away. Occasionally, he will forget to turn off Wi-Fi before he enters. Screams of protest fill the air. He turns off Wi-Fi, they flush their ARP tables, and peace returns.