> now if i > > ; ip/ping /net.alt/icmp!12.51.113.7!0 > > i usually get one packet back and snoopy reports
there are surely more packets than that. for example, where are the arp packets that initially discover that 12.51.113.7 is 0030488ef4fb? i suspect that the machine is sending out an arp request for 12.51.113.7 and getting back responses both from the actual 12.51.113.7 as well as the 65 gateway. the 65 gateway responds a little bit later, so that you manage to get one ping off between getting the first response and the second response. if this is the case, then your 65 gateway is wrong. alternately, it could be that the 65 gateway is somehow getting the ping traffic and responding with a "no route to host" and somehow that response is poisoning the arp cache. snoopy -f 'icmp || arp' would tell for sure. it would also be nice to see the output of netstat -i. russ
