On Mon, 11 Oct 2021, Markus Falb wrote: >> On 11.10.2021, at 17:22, Simon Matter <simon.matter at invoca.ch> wrote: >> >> Are you even sure it's NetworkManager messing with your MAC addresses? >> I have no idea why NM should ever mess with MAC addresses on a server >> and I don't expect NM is doing so. >> >> I have another idea: Seems this is on a SuperMicro server, can it be >> that the box in question has a shared lights out management, sharing >> the management ethernet port with the first LAN port? If so, can it be >> that the management port is not configured properly and does try to >> DHCP an IPv4 address? If you don't need the management stuff then you >> may try to simply disable it to get rid of the mess. > > Yeah, there is a default setting in the Firmware of “failover” which means > “use dedicated IPMI port if connected otherwise use shared LAN port” > > This is under IPMI -> BMC Network Configuration > see also https://serverfault.com/questions/361940/configuring-supermicro-ipmi-to-use-one-of-the-lan-interfaces-instead-of-the-ipmi thanks to you both for this idea, which is excellent, and i shall test (and report back) when i have a spare couple of hours. > But, is this kind of traffic supposed to be visible to the linux kernel? > (or was the tcpdump made on another machine?) no, the tcpdump was done on the machine itself, and i wouldn't have expected it to be visible to the kernel. but if this turns out to be the issue, i'll be glad that it was! otherwise it might have continued to go down the pipe invisibly, save for its effect on my internet traffic. -- Tom Yates - https://www.teaparty.net