Apple devices spoofing default gateway?

Thu Mar 14 12:27:38 UTC 2019

All,

We're seeing a bit of a weird one on our network at the moment, and wondering
if anyone else has seen it.

Since Friday we're seeing Apple devices (we believe it's both laptops and 
iPhones) responding to ARP requests for the default gateway IP with their own
MAC address (i.e. ARP spoofing / MITM type attack). We're only seeing it on
Apple devices, but what's more strange is that we're only seeing it where 
those Apple devices are connected to Cisco 1810 and 1815 APs, and where those
APs are connected to a Cisco WLC running v8.5 software. If we downgrade the
WLC to v8.2 the problem goes away (but v8.2 doesn't support 1815 APs, so we 
can't roll that out globally). We're engaged with Cisco TAC, but they're 
trying to deny it's their problem. Apple support are investigating, but aren't
admitting to having seen it before.

Has anyone else seen or heard of similar issues over the last few days?

Many thanks,

Simon