# Supermicro IPMI Recovery over IPv6

> Getting Into a Headless Supermicro BMC via Link-Local IPv6

By Zsolt Bizderi · Published 2026-11-13
Canonical: https://ambientnode.uk/supermicro-bmc-kvm

I had a used Supermicro board (X11SSH) whose IPMI was left on a static IPv4 in a subnet I didn't know. It never pulled a DHCP lease, so it never showed up on the LAN and I had no idea what address it was configured to use. This is a quick guide to reaching the BMC over IPv6 link-local anyway and resetting its network config so it can be reached over IPv4.

On a Supermicro/AMI board, the BMC auto-configures an IPv6 link-local address on a direct cable and it always works once the BMC has initialised. The idea is to get its IPv6 address, bridge it with `socat`, log in and set a new, working static IP.

## Video Out, BMC In

The X11SSH's onboard VGA is driven by the AST2500 BMC, not the CPU. The CPU has no integrated graphics, so BMC-driven VGA is the only local output. Adding a GPU won't help as Supermicro defaults primary display to onboard, and you can't change that without seeing the screen you're trying to enable.

Check the heartbeat LED near the AST2500. A \~1 Hz blink means the BMC is up on standby power. If it's blinking, this is an access problem and the below should help you regain access to it.

## Link-local IPv6 + socat

Every interface with a live link auto-configures an `fe80::/10` address from its MAC. A BMC with broken IPv4 still has working IPv6 link-local. 
Capture IPv6 on the wired interface, then cold-boot the BMC (mains out, wait, back in) so the NIC re-inits and fires its solicitations:

```
sudo tcpdump -i enx00e04c001122 -n -e ip6
```

If tcpdump shows nothing, the BMC's NIC is wedged. A soft reboot won't fix it (it holds state on the 5V standby rail). Pull the PSU cable for 2–3 min to drain standby power. If it's still not working, clear CMOS via JBT1 so the board re-inits the stuck BMC NIC.

The BMC's neighbour solicitation will show its IPv6 address:

```
3c:ec:ef:aa:bb:cc > 33:33:...: ICMP6, neighbor solicitation,
    who has fe80::3eec:efff:feaa:bbcc
fe80::3eec:efff:feaa:bbcc > ff02::2: ICMP6, router solicitation
```


Alternatively, you can also derive this from the MAC via EUI-64: split the MAC in half, insert `ff:fe` in the middle, and flip the seventh bit of the first octet. `3c:ec:ef:aa:bb:cc` \> first octet `3c` (`0011 1100`) becomes `3e` (`0011 1110`) > `fe80::3eec:efff:feaa:bbcc`. 

Confirm reachability:

```
ping6 -c2 fe80::3eec:efff:feaa:bbcc%enx00e04c001122
```

Browsers reject the `%zone` in a URL, so bridge it by listening on IPv4 localhost and forward to the BMC. The browser only sends traffic to localhost, fixing the zone issue:

```
sudo socat TCP-LISTEN:8443,fork,reuseaddr \
    TCP6:[fe80::3eec:efff:feaa:bbcc%enx00e04c001122]:443
```

Browse to `https://localhost:8443` and log in with `ADMIN`/`ADMIN`, or the unique password on the PCB sticker. Then go to **Configuration > Network** and set a working static IPv4 or DHCP so the board shows up on your LAN like a normal device from now on. Applying the change drops the IPv6 session and the socat tunnel as the NIC re-inits.