hi, > Does the linux kernel cache the source IP of unsolicited ARP requests? > If so, does it cache Gratuitous ARP? just guessing but net/ipv4/arp.c arp_process() has some lines like these: #ifdef CONFIG_IP_ACCEPT_UNSOLICITED_ARP /* Unsolicited ARP is not accepted by default. It is possible, that this option should be enabled for some devices (strip is candidate) */ if (n == NULL && arp->ar_op == __constant_htons(ARPOP_REPLY) && inet_addr_type(sip) == RTN_UNICAST) n = __neigh_lookup(&arp_tbl, &sip, dev, -1); #endif - does it help? kenji - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html