I'm more interested to know about the endpoint that was responding to all IPs. Also, minor nitpick: > Without that we would have been reduced to tracing throu

I'm more interested to know about the endpoint that was responding to all IPs. Also, minor nitpick: > Without that we would have been reduced to tracing through switch ARP tables (for switches smart enough to report that) You'd only need your switch to have a viewable mac address table rather than an ARP table.