Windows 2003 server serving up "wrong" MAC to arp clients?

[Rob G]

I'm experiencing a really bizarre issue, with a Windows 2003 server on
my network serving out a "wrong" MAC address when it's serving it's MAC
to arp clients.

I have a Windows 2003 Standard server, acting as my FSMO master on a
Windows 2003 native domain, with dual built-in Broadcom 1GbE nics. I
have disabled the second nic in Windows, and am using the primary nic
for all connectivity.

If I look directly in the BIOS, I can see what the hardware MAC
addresses of each interface are. Then when I boot into Windows, and I
use the Broadcom server utility, it also shows me the same MAC addresses
assigned to each nic, and it also shows the second nic as disabled.

However, when I take a client (XP/2003/Vista/Win 7) and I completely
clear it's arp cache and I attempt a ping to the server in question,
after the ping I check the client's arp cache and it's showing a
completely different MAC address for the server's IP address. The
first five octets of the MAC are the same as the server vendor, so the
arp is definitely coming from that machine.

Could this be something screwy in the server's registry? I'm just at a
loss to understand how this server would be giving out a skewed MAC
address when everything at both the hardware layer and software layer
appear to be correct.

Any ideas?

 

[Rob G]

Ah, never mind I think I identified the issue. This is a Dell server,
and even though there isn't a physical out-of-band interface card
installed in the server , I just realized that I noticed that the
IPMI/BMC interface has been configured with the same IP as NIC 1.

I'm pretty sure that once I set that back to zero, the problem will go
away.

Rob G wrote:
> I'm experiencing a really bizarre issue, with a Windows 2003 server on
> my network serving out a "wrong" MAC address when it's serving it's MAC
> to arp clients.
>
> I have a Windows 2003 Standard server, acting as my FSMO master on a
> Windows 2003 native domain, with dual built-in Broadcom 1GbE nics. I
> have disabled the second nic in Windows, and am using the primary nic
> for all connectivity.
>
> If I look directly in the BIOS, I can see what the hardware MAC
> addresses of each interface are. Then when I boot into Windows, and I
> use the Broadcom server utility, it also shows me the same MAC addresses
> assigned to each nic, and it also shows the second nic as disabled.
>
> However, when I take a client (XP/2003/Vista/Win 7) and I completely
> clear it's arp cache and I attempt a ping to the server in question,
> after the ping I check the client's arp cache and it's showing a
> completely different MAC address for the server's IP address. The
> first five octets of the MAC are the same as the server vendor, so the
> arp is definitely coming from that machine.
>
> Could this be something screwy in the server's registry? I'm just at a
> loss to understand how this server would be giving out a skewed MAC
> address when everything at both the hardware layer and software layer
> appear to be correct.
>
> Any ideas?

 

[Lanwench [MVP - Exchange]]

Rob G wrote:
> Ah, never mind I think I identified the issue. This is a Dell server,
> and even though there isn't a physical out-of-band interface card
> installed in the server , I just realized that I noticed that the
> IPMI/BMC interface has been configured with the same IP as NIC 1.
>
> I'm pretty sure that once I set that back to zero, the problem will
> go away.

I'm curious as to whether this is actually causing you any problems or
whether you're just trying to do some tidying up. What is happing on the
network that caused you to look at this in the first place?

 

[Grant Taylor]

On 09/16/09 02:54, Rob G wrote:
> Ah, never mind I think I identified the issue. This is a Dell server,
> and even though there isn't a physical out-of-band interface card
> installed in the server , I just realized that I noticed that the
> IPMI/BMC interface has been configured with the same IP as NIC 1.

That could be a problem.

> I'm pretty sure that once I set that back to zero, the problem will go
> away.

You could also manually set the arp entry on a workstation to the proper
MAC address and then try pinging the IP.



Grant. . . .

 

[Rob G]

That was definitely the problem.

The same internal Broadcom chipset that controls the onboard NICs also
controls the BMC, so it was sending out "ghosted" arp requests for the
same IP assigned to both the devices, once for the physical mac of NIC1
and once for the internal virtual NIC of the IPMI/BMC controller.

Grant Taylor wrote:
> On 09/16/09 02:54, Rob G wrote:
>> Ah, never mind I think I identified the issue. This is a Dell server,
>> and even though there isn't a physical out-of-band interface card
>> installed in the server , I just realized that I noticed that the
>> IPMI/BMC interface has been configured with the same IP as NIC 1.
>
> That could be a problem.
>
>> I'm pretty sure that once I set that back to zero, the problem will
>> go away.
>
> You could also manually set the arp entry on a workstation to the proper
> MAC address and then try pinging the IP.
>
>
>
> Grant. . . .