Due to some internal network problems I fired up Wireshark and saw a lot of gratuitous ARP requests/broadcasts. I had never seen the sending MAC or IP before but could assign it to one the ports our switching hardware. The designated port was used for a Citrix XenServer virtualization environment, so at first I suspected a miconfiguration of one of the bonds and some looping ARP packets. This assumption was wrong: I shutted down the server and the ARP requests still came from the physical network interface, so it could only be a problem/configuration of the interface itself.
I googled for “intel gratuitious ARP” and found the answer: the Intel NIC had an IPMI module and was sending announcements but the GUI was disabled.
Fixing the problem was easy. I ssh’ed into to the Citrix XenServer and used the ipmitool to disable the ARP sending mechanism:
modprobe ipmi_devintf; modprobe ipmi_si ipmitool -d /dev/ipmi0 lan set 1 arp generate off
