Due to some internal network problems I fired up Wireshark and saw a lot of gratuitous ARP requests/broadcasts. I had never seen the sending MAC or IP before but could assign it to one the ports our switching hardware. The designated port was used for a Citrix XenServer virtualization environment, so at first I suspected a miconfiguration of one of the bonds and some looping ARP packets. This assumption was wrong: I shutted down the server and the ARP requests still came from the physical network interface, so it could only be a problem/configuration of the interface itself.

I googled for “intel gratuitious ARP” and found the answer: the Intel NIC had an IPMI module and was sending announcements but the GUI was disabled.
Fixing the problem was easy. I ssh’ed into to the Citrix XenServer and used the ipmitool to disable the ARP sending mechanism:

modprobe ipmi_devintf; modprobe ipmi_si
ipmitool -d /dev/ipmi0 lan set 1 arp generate off

I am asking you for a donation.

You liked the content or this article has helped and reduced the amount of time you have struggled with this issue? Please donate a few bucks so I can keep going with solving challenges.

Categories: Networking