My pfSense firewall running arpwatch detected one of our ancient Server 2003 boxes doing this: May 1 10:11:54 kernel: arp: 10.1.1.12 moved from...
Separate names with a comma.