>> so...if i send a reply to my machine at 204.17.3.77 from 205.17.3.125,
>> it should get a warning printed, yesh?
>
>I'm not sure I fully made me understood.

me...or you?

>ARP packets aren't IP packets. They don't have IP src and destination.

yes, that i know.  they're 

[ethernet header with arp type code]
[arp link type, ethernet=0x0001]
[arp upper layer, ip=0x0800]
[link address length, ethernet=0x06]
[upper layer address length, ip=0x04]
[arp type query=0x0001, reply=0x0002]

and then a pair of ethernet and ip address combinations.  for
requests, the second ethernet address is usually all ones or all
zeroes.

>If you send an ARP packet
>
>- from any MAC address to the MAC address of 204.17.3.77, 
>that contains 
>- a reply claiming that 205.17.3.125 is at another MAC address
>
>(at the same time claiming that 204.17.3.77 is at its own MAC address, in
> the requestor field of the ARP packet; I'm not sure what happens if you
> use a 4th machines data there)

that's what i was trying...

>the message should be seen.

...but it seems, upon inspection, that arplookup() is not being called
with create set, so the message is not printed.  on to dig deeper...

>(This is a fine, but necessary distinction.)

of course.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."