Revision history  [back]

DEFINITELY MALICIOUS ! Its a symptom of Man in the middle attacks. Take a look at the MAC-IP assignments on the network by monitoring with something like arpwatch, I'm pretty sure you'll detect duplicate MACs. There's no reason to make a ARP query from a fake device and specify a return path different that the source, or even worse, a return path outside the network ! :O I found the same issue on one of my managed networks...