ok. same thing with 386_5.2. more info I found. The device is an industrial equipment plugged on the net. And it always responds to arp requests with 50 bytes instead of the usual 46 bytes used by PCs on the net. For some reason, all arp replies with 46 bytes can be seen by tcpdump on the br0...