Question for the big brained hive mind. How to find the MAC address of the passive member of an active/passive teamed NIC.

We are in the process of a data center migration to application-centric ACI. We currently have all layer three in the DC routing via ACI network-centric mode with most devices traversing L2Out for their respective VLANs. Right now we just have a couple of 10Gb connections between ACI and our old core, so our current step is to directly connect the ToR switches to ACI leaf switches.

The documentation has not been kept up to date (as per the usual, I find), so I've written a series of scripts to identify what device is on every legacy port in the DC. It grabs the MAC address table from each ToR switch, then does a lookup against a list of MAC's provided by our sysadmins, failing that search it grabs the endpoints table from ACI and looks up the IP, then does a reverse DNS lookup to determine server/device name, failing that, it looks in the old core's ARP table. Once it has that info it dumps it into an Excel spreadsheet to assist with planning the move (it also grabs port config and a few other things, mainly because more data is better).

The problem that I'm running into is servers that have teamed NICs in active/passive mode. The passive NICs don't talk much, so the entries age out of the cam tables, which means I can't find them. Which leads to my question.

Does anyone know how to make these passive NICs talk (without disconnecting the active) so that I can find them? The servers are mostly HP of all ages and lineages. With a few Dells thrown in for good measure. Does anyone know of an HP tool that would do that, or any other tool for that matter? Pretty sure that I'm pissing in the wind and we'll just have to do it that hard way, but it's worth a shot asking the big dawgs out there in Reddit land.