>> arplookup() in if_arp.c sometimes spews this message
>> 
>>     "arplookup: unable to enter address for %s (%s)"
>> 
>> and i thought i understood what triggered it, but apparently i'm
>> wrong.  or...i'm not the net.hacker i thought i was.
>> 
>> can someone please describe a packet or sequence of packets (i imagine
>> two at most) which will trigger this message?  i can manufacture
>> packets quite easily using bpf (except the ethernet source address),
>> but can't get this code sequence to trigger.
>
>I think[1] an ARP packet from a different IPv4 network on your Ethernet will
>trigger it. To be precise: an ARP packet with the src IPv4 address in the
>data area belonging to a IPv4 address which does not belong to the IPv4 network
>configures on the incoming interface.

request or reply?  i guess i can try both...

>[1] But I'd have to check the source to verify.

i tried that, but i'm not entirely sure what i'm looking at.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."