On Wed, Oct 27, 2021, 4:53 AM grarpamp <[1]grarpamp@gmail.com> wrote: > the arp packet came from 10.0.0.1 This may not hardly be true, it came from ye who decided to write the raw packet as such and drop it on the wire, your receipt of is subject to any antispoofing provisions, which are not necessarily done. what are you talking about? usually when i'm diagnosing things I make serious errors, often including paranoid assumptions. spamlogs here are just my personal experience, not hard fact. References 1. mailto:grarpamp@gmail.com