>The right answer is IPsec.

well...yeah, but it's not really an option for a combination
wired/wireless network, unless i turn off net.inet.ip.subnetsarelocal,
or can establish a security relationship between myself and the access
point which acts as a bridge (and not a router).

it also doesn't help my non-ip traffic at all.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."