IPMI (Intelligent Platform Management Interface) is the industry standard protocol for hardware-level management. As a network engineer, you have probably used IPMI commands to power-cycle servers. But what is IPMI actually doing under the hood?

IPMI defines a message-based protocol. Every message has a header containing:

• NetFn (Network Function): a 6-bit field that categorises the command. Common values: 0x00 = Chassis commands (power control, boot order), 0x04 = Sensor commands, 0x06 = Application commands (get device ID, self-test), 0x0A = Storage commands (event log, SDR -- Sensor Data Repository).
• Command: an 8-bit opcode within the NetFn category. For example, within NetFn 0x00 (Chassis), Command 0x01 = Get Chassis Status, Command 0x02 = Chassis Control (the power-on/off command).
• Data: command-specific payload. The power control command carries one data byte: 0x00 = power down, 0x01 = power up, 0x02 = power cycle, 0x03 = hard reset.
• Checksum: two 1-byte checksums, one covering the addressing bytes and one covering the rest of the message.

IPMI messages travel over several transport layers:

IPMI over LAN (IPMI 2.0): This is what you use when you run ipmitool -H <bmc-ip> from a management workstation. The message is encapsulated in UDP on port 623. IPMI 2.0 added RAKP (Remote Authenticated Key-Exchange Protocol) for session establishment and HMAC-based authentication, replacing the weak MD5-based authentication in IPMI 1.5.

# Power status
ipmitool -I lanplus -H 10.0.1.10 -U admin -P <pass> chassis status

# Power cycle
ipmitool -I lanplus -H 10.0.1.10 -U admin -P <pass> chassis power cycle

# List all sensor readings (temperature, fan speed, voltage)
ipmitool -I lanplus -H 10.0.1.10 -U admin -P <pass> sdr elist

# Get event log
ipmitool -I lanplus -H 10.0.1.10 -U admin -P <pass> sel list

# Virtual console (SOL -- Serial Over LAN)
ipmitool -I lanplus -H 10.0.1.10 -U admin -P <pass> sol activate

IPMI over KCS (Keyboard Controller Style): This is the in-band path. When the host OS runs ipmitool without a -H flag, it communicates with the local BMC via the KCS interface -- a small register-mapped I/O port (0xCA0/0xCA2 on x86). The kernel ipmi_si module provides this path. Useful when you want to query sensor data from within the host OS without network access to the BMC.

Sensor Data Repository (SDR): The BMC maintains an SDR -- a catalogue of all sensors on the system. Each SDR record describes a sensor: its type (temperature, voltage, fan), its location (CPU 1, PCIe slot 3, PSU 2), its reading format, and its threshold values for warning and critical alarms. When you run ipmitool sdr elist, the ipmitool fetches these records from the SDR and formats them for display.