>> 2006-03-31 07:52:08.858034 arp who-has 0.0.0.0 tell 88.xx.xx.xx
>> 2006-03-31 07:52:08.858604 arp who-has 0.0.0.0 tell 88.xx.xx.xx
> [T]his looks like backscatter from a misconfigured (or attacking)
> machine that contacts the 88.xx.xx.xx using 0.0.0.0 as the source
> address.

How would that do it?  0.0.0.0 is off-net for 88.x.x.x unless the
netmask is /1, /0, or noncontiguous (which are all pretty implausible),
so it shouldn't even *be* ARPing for it, as far as I can see.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       mouse@rodents.montreal.qc.ca
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B