Tag Info

An ARP scan typically works by sending an ARP request to every ip address in a particular subnet, so I don't see how it's likely that the MAC addresses are being hashed (I'm not even sure what that means) and I don't think it's a caching issue as I'm assuming the machine initiating the ARP scan doesn't use it's own ARP cache during the scan and if it does ...

This seems to be a case of Apple Sleep Proxy Service. http://en.m.wikipedia.org/wiki/Sleep_Proxy_Service "When a Sleep Proxy sees an IPv4 ARP or IPv6 ND Request for one of the sleeping device's addresses, it answers on behalf of the sleeping device, without waking it up, giving its own MAC address as the current (temporary) owner of that address."

A 802.11 network, unlike a wired network, use acknowledgments to indicate that a frame was received successfully. It is used because the link is so lossy that most upper layers would be unable to cope with the sheer loss rate, so a lack of an acknowledgment will result in a retransmission. And it solves another problem: a 802.11 network is a shared media ...