@mcscx I didn't save the Wireshark capture, but it looked like IPs from all over the internets asking about other IPs all over the internets. Could be malicious doorknob rattling. I don't know what kind of frames are on the cable side of the modem; it just delivers plain ol' Ethernet to the pfSense box. I should have full access to that cable modem, but I'm disinclined to take the network offline to poke at it, and disinclined to poke at it because I don't know enough about cable config settings.