> the arp packet came from 10.0.0.1 This may not hardly be true, it came from ye who decided to write the raw packet as such and drop it on the wire, your receipt of is subject to any antispoofing provisions, which are not necessarily done.