Higher Education

I know iOS 8 is not out yet, but it appears there are some big changes with how it handles wifi SSID probing and I am concerned about how this could possibly effect our network.   Because VAPs on the aruba gear create a new AP (virtual AP) with its own mac address, I would think that this could be problematic with iOS 8 using fake mac addresses for probing.  It would seem to me that this would cause a lot of additional connections to our infrastructure, and could maybe even hurt the ability for the aruba gear to appropriatly hanlde these connections - as the aruba controller would see these probes as simply another device and not the one that is already connected to an VAP.  Their reasoning behind this is to help stop tracking based on mac address, but IMO there are very real world reasons to track mac address especially in large partially uncontrolled networks (byod/ schools/ universities)...

Maybe its nothing, but I would like to see some response to this sooner than later (I dont want to see iOS8 drop down the pipe and then run into massive wifi issues...)

Here is an article on the subject.

http://qz.com/218437/a-tiny-technical-change-in-ios-8-could-stop-marketers-spying-on-you/

Thanks,

Dan

Unless I am reading this wrong, it looks to me mac authentication would be broken. 

---

@davidbr wrote:

Unless I am reading this wrong, it looks to me mac authentication would be broken. 

---

I would also think this could cause a massive spike in log data... and possibly some other issues because the aruba gear would think that a different "new" device is probing the SSIDs (that are not authenticated to).  Part of this has to do with the fact that Aruba uses virtual Aps, and each one acts like its own AP with a unique mac address - unlike other wifi devices that have a single BSSID and then use ESSIDs for the different SSIDs.  This means there is one Mac address associated with all SSIDS so the iOS device would not probe that AP with a fake mac.  

On the aruba gear each VAP is a unique mac address so the iOS device would think each SSID is a new AP...

danstl and davidbr,

We probably want to wait until IOS8 comes out to determine what will happen.  It is great to have a discussion about concepts, but until we know the exact implementation as shipped, I am not sure there is much that can be said  definitively.  I see discussion about mac authentication and Virtual APs in this thread, and based on the technical information put out in Apple's slides, that functionality will not be affected, but we have to wait until it comes out for anyone to say anything with conviction, because anything that is not shipping is subject to change...

---

@cjoseph wrote:

danstl and davidbr,

 

We probably want to wait until IOS8 comes out to determine what will happen.  It is great to have a discussion about concepts, but until we know the exact implementation as shipped, I am not sure there is much that can be said  definitively.  I see discussion about mac authentication and Virtual APs in this thread, and based on the technical information put out in Apple's slides, that functionality will not be affected, but we have to wait until it comes out for anyone to say anything with conviction, because anything that is not shipping is subject to change...

---

Do you test pre-release iOS versions?  The only reason I ask is that we obviously have little control over our users personal devices, and Apple will most likely release iOS 8 in October.  If there were any issues indicated with the Beta iOS8 release would we be informed?  

I'm guessing this relates to broadcast probes and not association requests, where I suspect the real MAC is used. So, guessing not an issue for non-marketing connections. What is interesting is how Meridian might be affected. Seems this is the target vector.

Mike

We're already looking into these questions.  It's too soon to say exactly what all this means, but we will be prepared.