一個奇特的mac地址自動變化

公司有一臺dell伺服器,分公司同事反映業務系統斷斷續續的，有時候可以登入，有時不能登陸，可是ping有一直正常。

1，正常時候的mac地址資訊
[root@tonykorn97 ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:1D:09:08:A9:8D
inet addr:172.23.4.250 Bcast:172.23.4.255 Mask:255.255.255.0
inet6 addr: fe80::21d:9ff:fe08:a98d/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:90056 errors:0 dropped:0 overruns:0 frame:0
TX packets:84881 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:8917134 (8.5 MiB) TX bytes:19043014 (18.1 MiB)
Interrupt:169 Memory:f4000000-f4011100

2，網路不通的時候從路由器上得到的mac地址資訊。
tonykorn97#show arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 172.23.4.254 - 000b.4615.4706 ARPA FastEthernet0/0
Internet 172.23.4.250 0 001d.0908.a98f ARPA FastEthernet0/0

3，其他操作
tonykorn97#ping 172.23.4.250

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.23.4.250, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 37/39/40 ms
tonykorn97#

tonykorn97#show arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 172.23.4.254 - 000b.4615.4706 ARPA FastEthernet0/0
Internet 172.23.4.250 0 001d.0908.a98d ARPA FastEthernet0/0

4，察看dmesg資訊：
bnx2: eth0 NIC Link is Down
bnx2: eth0 NIC Link is Up, 1000 Mbps full duplex, receive & transmit flow control ON
bnx2: eth0 NIC Link is Down
bnx2: eth0 NIC Link is Up, 1000 Mbps full duplex, receive & transmit flow control ON

5，把另外一個ip地址啟動起來後，察看ip地址資訊：
eth0 Link encap:Ethernet HWaddr 00:1D:09:08:A9:8D
inet addr:172.23.4.250 Bcast:172.23.4.255 Mask:255.255.255.0
inet6 addr: fe80::21d:9ff:fe08:a98d/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:180588 errors:0 dropped:0 overruns:0 frame:0
TX packets:183393 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:36726016 (35.0 MiB) TX bytes:81334474 (77.5 MiB)
Interrupt:169 Memory:f4000000-f4011100

eth1 Link encap:Ethernet HWaddr 00:1D:09:08:A9:8B
inet addr:172.23.4.252 Bcast:172.23.4.255 Mask:255.255.255.0
inet6 addr: fe80::21d:9ff:fe08:a98b/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:404 (404.0 b)
Interrupt:169 Memory:f8000000-f8011100

6，然後看到mac地址其中一個會變

tonykorn97#show arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 172.23.4.254 - 000b.4615.4706 ARPA FastEthernet0/0
Internet 172.23.4.252 4 001d.0908.a98b ARPA FastEthernet0/0
Internet 172.23.4.250 1 001d.0908.a98f ARPA FastEthernet0/0

7，把eth0從172.23.4.250變為172.23.4.251 並且停止
把eth1從252改為250

[root@tonykorn97 ~]# ifconfig
eth1 Link encap:Ethernet HWaddr 00:1D:09:08:A9:8B
inet addr:172.23.4.250 Bcast:172.23.4.255 Mask:255.255.255.0
inet6 addr: fe80::21d:9ff:fe08:a98b/64 Scope:Link

後續繼續觀察

觀察一天，mac地址沒有變

[root@tonykorn97 ~]# ifconfig
eth1 Link encap:Ethernet HWaddr 00:1D:09:08:A9:8B
inet addr:172.23.4.250 Bcast:172.23.4.255 Mask:255.255.255.0

接著發現mac地址有變為：
tonykorn97#show arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 172.23.4.254 - 000b.4615.4706 ARPA FastEthernet0/0
Internet 172.23.4.250 5 001d.0908.a98f ARPA FastEthernet0/0

mac地址：
[root@tonykorn97 ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:1D:09:08:A9:8D
inet addr:172.23.4.252 Bcast:172.23.4.255 Mask:255.255.255.0

eth1 Link encap:Ethernet HWaddr 00:1D:09:08:A9:8B
inet addr:172.23.4.250 Bcast:172.23.4.255 Mask:255.255.255.0

8，重新安裝驅動

[root@tonykorn97 ~]# rpm -ivh bnx2-1.5.10c-1.src.rpm
1:bnx2 ########################################### [100%]

[root@tonykorn97 ~]# cd /usr/src/redhat/
BUILD/ RPMS/ SOURCES/ SPECS/ SRPMS/

[root@tonykorn97 redhat]# rpmbuild -bb SPECS/bnx2.spec

+ rm -rf /var/tmp/bnx2-buildroot /usr/src/redhat/BUILD/file.list.bnx2
+ exit 0
[root@tonykorn97 redhat]# ls
BUILD RPMS SOURCES SPECS SRPMS
[root@tonykorn97 redhat]# cd RPMS/
[root@tonykorn97 RPMS]# cd x86_64/
[root@tonykorn97 x86_64]# rpm -ivh bnx2-1.5.10c-1.x86_64.rpm
Preparing... ########################################### [100%]
1:bnx2 ########################################### [100%]
[root@tonykorn97 x86_64]#

[root@tonykorn97 net]# modprobe bnx2

/etc/init.d/network restart 重啟network

9，發現ttl值有變化：
64 bytes from 172.23.4.250: icmp_seq=17050 ttl=125 time=44.2 ms
64 bytes from 172.23.4.250: icmp_seq=17051 ttl=125 time=44.1 ms
64 bytes from 172.23.4.250: icmp_seq=17052 ttl=125 time=45.3 ms
64 bytes from 172.23.4.250: icmp_seq=17053 ttl=61 time=10.2 ms
64 bytes from 172.23.4.250: icmp_seq=17054 ttl=61 time=10.2 ms
64 bytes from 172.23.4.250: icmp_seq=17055 ttl=61 time=10.3 ms

此時估計就是有機器中病毒了.

關閉一些服務，重啟。情況還是一樣.

只剩一臺路由器,一臺主交換機,和一個伺服器.然後一直ping。看還有沒有ttl值變化的。

在晚上11點到12點的時候出現問題
64 bytes from 172.23.4.250: icmp_seq=15596 ttl=61 time=10.1 ms
64 bytes from 172.23.4.250: icmp_seq=15597 ttl=61 time=10.2 ms
64 bytes from 172.23.4.250: icmp_seq=15598 ttl=125 time=64.3 ms
64 bytes from 172.23.4.250: icmp_seq=15599 ttl=125 time=44.2 ms

10，發現dmesg資訊：
MSI INIT SUCCESS
bnx2: eth1: using MSI
bnx2: eth1 NIC Copper Link is Up, 1000 Mbps full duplex
lp: driver loaded but no devices found
NET: Registered protocol family 10
Disabled Privacy Extensions on device ffffffff80405540(lo)
IPv6 over IPv4 tunneling driver
divert: not allocating divert_blk for non-ethernet device sit0
eth1: no IPv6 routers present
device eth1 entered promiscuous mode
device eth1 left promiscuous mode
device eth1 entered promiscuous mode
device eth1 left promiscuous mode
device eth1 entered promiscuous mode
device eth1 left promiscuous mode
device eth1 entered promiscuous mode
device eth1 left promiscuous mode
ip_tables: (C) 2000-2002 Netfilter core team
bnx2: eth0: using MSI
bnx2: eth0 NIC Copper Link is Up, 100 Mbps half duplex
eth0: no IPv6 routers present

dmesg資訊IRQ號一樣：
divert: allocating divert_blk for eth0
eth0: Broadcom NetXtreme II BCM5708 1000Base-T (B2) PCI-X 64-bit 133MHz found at mem f4000000, IRQ 1
69, node addr 001d0908a98d
ACPI: PCI interrupt 0000:05:00.0[A] -> GSI 16 (level, low) -> IRQ 169
divert: allocating divert_blk for eth1
eth1: Broadcom NetXtreme II BCM5708 1000Base-T (B2) PCI-X 64-bit 133MHz found at mem f8000000, IRQ 1
69, node addr 001d0908a98b
最後查明也不是這個原因。

11，最後的原因是：
發現是啟動了dell 底板管理控制器（BMC），在這裡配置了一個ip地址和伺服器ip地址重複。