Today I learned that a 2850 with a BMC configured to do IPMI over LAN with a static ip but no DRAC will keep the ip address you assign it and respond to arping, but will not respond to ping or anything else that nmap -O throws at it. Also that it'll do that over the primary network interface, taking the next MAC in sequence from the nics themselves. (eg: if the last octet on the two physical nics are :37 and :38, the BMC's hijacking of the NIC will be on :39).

I hope that this helps someone other than me and my officemate, at some point in the future. But I doubt it will.

This glimpse of the mysterious world of sysadmins in r&d companies brought to you by ... my r&d company!