I had a used Supermicro board (X11SSH) whose IPMI was left on a static IPv4 in a subnet I didn't know. It never pulled a DHCP lease, so it never showed up on the LAN and I had no idea what address it was configured to use. This is a quick guide to reaching the BMC over IPv6 link-local anyway and resetting its network config so it can be reached over IPv4.
On a Supermicro/AMI board, the BMC auto-configures an IPv6 link-local address on a direct cable and it always works once the BMC has initialised. The idea is to get its IPv6 address, bridge it with socat, log in and set a new, working static IP.
Video Out, BMC In
The X11SSH's onboard VGA is driven by the AST2500 BMC, not the CPU. The CPU has no integrated graphics, so BMC-driven VGA is the only local output. Adding a GPU won't help as Supermicro defaults primary display to onboard, and you can't change that without seeing the screen you're trying to enable.
Check the heartbeat LED near the AST2500. A \~1 Hz blink means the BMC is up on standby power. If it's blinking, this is an access problem and the below should help you regain access to it.
Link-local IPv6 + socat
Every interface with a live link auto-configures an fe80::/10 address from its MAC. A BMC with broken IPv4 still has working IPv6 link-local.
Capture IPv6 on the wired interface, then cold-boot the BMC (mains out, wait, back in) so the NIC re-inits and fires its solicitations:
sudo tcpdump -i enx00e04c001122 -n -e ip6
If tcpdump shows nothing, the BMC's NIC is wedged. A soft reboot won't fix it (it holds state on the 5V standby rail). Pull the PSU cable for 2–3 min to drain standby power. If it's still not working, clear CMOS via JBT1 so the board re-inits the stuck BMC NIC.
The BMC's neighbour solicitation will show its IPv6 address:
3c:ec:ef:aa:bb:cc > 33:33:...: ICMP6, neighbor solicitation,
who has fe80::3eec:efff:feaa:bbcc
fe80::3eec:efff:feaa:bbcc > ff02::2: ICMP6, router solicitation
Alternatively, you can also derive this from the MAC via EUI-64: split the MAC in half, insert ff:fe in the middle, and flip the seventh bit of the first octet. 3c:ec:ef:aa:bb:cc > first octet 3c (0011 1100) becomes 3e (0011 1110) > fe80::3eec:efff:feaa:bbcc.
Confirm reachability:
ping6 -c2 fe80::3eec:efff:feaa:bbcc%enx00e04c001122
Browsers reject the %zone in a URL, so bridge it by listening on IPv4 localhost and forward to the BMC. The browser only sends traffic to localhost, fixing the zone issue:
sudo socat TCP-LISTEN:8443,fork,reuseaddr \
TCP6:[fe80::3eec:efff:feaa:bbcc%enx00e04c001122]:443
Browse to https://localhost:8443 and log in with ADMIN/ADMIN, or the unique password on the PCB sticker. Then go to Configuration > Network and set a working static IPv4 or DHCP so the board shows up on your LAN like a normal device from now on. Applying the change drops the IPv6 session and the socat tunnel as the NIC re-inits.