Two big MACs with a NIC please

It was a dark and stormy night …. wait wrong story …

The scene opens with our rakishly good looking IT Manager, think a young Sean Connery or Harrison Ford, (played by me) sitting in a Aston Martin (the ultimate Bond car) at a drive through window. He is speaking off screen to the ingénue (a young, beautiful and often naïve girl) with a sexy voice, think any young movie actress making her screen debut, (portrayed by the svelte Dell PowerEdge 1850, who we’ll just call DPE). Her voice sounds like it is coming through a crackly speaker that has seen too much use and abuse.

              Welcome to frustration, may I take
              your order please?

                         IT MAN
              Yes, I'd like your two standard NIC
              combo, and a large cola.

              I'm sorry sir, we have only one
              regular NIC, I can upgrade your order
              to one regular and one double MAC
              free of charge

                         IT MAN
              I didn't think a double MAC was possible?

              It's a new item, in fact, we only have
              just this one.

                         IT MAN
              I'm not sure. I guess I'll take it,
              seeing as you don't have anything else.

              Your order will be $2.95, please pull
              up to the first window


                            THE END

Welcome to my frustration over the past couple of days. We have a server, yes a Dell PowerEdge 1850 to be exact, that came configured with two built-in Network Interface Cards (NIC). This server has been online for at least a year already, and working just fine.

Until, now. We want to install a network application on this server that requires that we provide the MAC address of the network card for licensing. Not a big deal, the MAC address is a globally unique address that every network card has. Each card has one hard coded into at the time of production. As mentioned our server has two cards therefore it should have two MAC address, in our case they end in 65 and 66 respectively. Except, that for some reason we also have one that end in 67.

This had me confused to a day or so, I couldn’t figure out why I was seeing 67 in the local ARP cache on the workstations when the server only had 65. The really weird thing was that the switches and routers would vacillate between 65 and 67. I’d clear the cache and it would stay one or the other until it timed out, then it would acquire the other one.

Eventually I pulled out my favorite network sniffer program, Ethereal, and looked at the raw network traffic. I first cleared the ARP cache on the client machine then I initiated a ping to the server, and here is the sequence of events (packets seen):

  1. Client broadcast an ARP request for Server
  2. Server responds to ARP with MAC address 65
  3. Server responds to ping request
  4. Server issues second ARP response with MAC address 67
  5. Server responds to subsequent ping requests from 67 address

I have never seen behavior like this before. So now I guess I’m leaning towards a defective NIC, but I don’t really think that is the problem. For the short term I’m just going to ignore the problem, and I’m going to disable that NIC card and use the other one which does not exhibit the behavior. I’m less clear about long term, because the NICs are on the motherboard it would mean swapping the whole thing. Oh well, it sure made for an interesting couple of days.

Leave a comment

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: