Possible issue with latest Intel NIC driver for 82579LM

[disk]

Last week we started running out of IP addresses in a few ranges where we were imaging for some Windows 8 to 8.1 upgrades. Looking at our Server 2008 R2 DHCP server, we saw something strange. There were a lot more addresses used than physical machines. There were a lot of entries where the MAC address was very long. They all started with 44454c4. After performing a search it looked as though these belonged to some type of VMWare vm (esx, workstation, player). I informed our network manager and he tracked them back to some of our Dell workstations running Windows 8.1. Out of almost 160 workstations that are all the same model (Dell OptiPlex 790) with the same image, close to 50 of them were taking 2 IP addresses. One normal IP associated with their actual MAC address and the other that made it look as though they were some type of VMWare VM.

 

We then noticed that this was happening in another range with just two machines. One was another OptiPlex 790 and the other was a newer OptiPlex 7010, both running Windows 8.1. Both of these models have the same Intel NIC. All were running the latest driver direct from Intel.com. I then went to Dell and downloaded their driver for Windows 8.1 (for the 7010 since the 790's don't list 8.1). I then applied this driver to both machines then turned them off and cleared out all associated DHCP entries. After turning them back on, the OptiPlex 790 no longer ate 2 IP's but the 7010 did. It was then that I realized that most of the IT staff are running Windows 8.1 on OptiPlex 7010's but are not having this issue. I checked a few machines and saw that they were running an older driver from 2012. This driver came down either from Windows itself or from Windows Updates.

 

I am in the process of recreating our Windows 8.1 image right now without the Intel NIC driver to see if our problem goes away.

 

Anyone else seen this phenomenon? I was going to post this in Intel's support forum on their site, but I didn't feel like creating an account. Besides, it doesn't look like it sees much traffic anyway (at least in the NIC area).

[Arthur]

Not sure about the 82579LM, but there was a fairly major issue with Intel's i217-LM NICs flooding networks with ICMPv6 multicast traffic recently.

 

• https://communities.intel.com/message/220048
  
• www.reddit.com/r/sysadmin/comments/2apn1u/intel_nics_ipv6_multicast_spam_when_sleeping/
  
• http://arstechnica.com/civis/viewtopic.php?f=10&t=1253571
  

For those who don't know, this started biting us hard the past week or so, even though it looks like the problem has "existed" since January?

 

Certain Intel NIC's (I217-LM for example) have a "bug" where they can spam IPV6 MultiCast Traffic with a TTL of 1 when they are sleeping/hibernating, or in a few other choice circumstances.

 

A few machines would sleep, and the resulting DDOS/packet spam would literally take down our switches.

 

http://en.community.dell.com/support-forums/desktop/f/3514/t/19523337.aspx?pi21953=4

 

It got bad enough that we are trying to patch/get everything up to the latest 19.0 release driver as fast as possible.

[disk]

Looked into it, but that is a different issue under different circumstances which appears to have been resolved by an updated driver back in March of this year.

[disk]

Just for fun I unchecked IPv6 from the Ethernet adapter on the 7010 and so far it has not taken a second IP address.