ARP packets do need the source IP address in them, as well as the MAC address.

Packets wouldn't even show up in WireShark without the source IP in it.

osdep/Arp.cpp

@@ -104,11 +104,11 @@ uint32_t Arp::processIncomingArp(const void *arp,unsigned int len,void *response
 	return ip;
 }
 
-MAC Arp::query(const MAC &localMac,uint32_t ip,void *query,unsigned int &queryLen,MAC &queryDest)
+MAC Arp::query(const MAC &localMac,uint32_t localIp,uint32_t targetIp,void *query,unsigned int &queryLen,MAC &queryDest)
 {
 	const uint64_t now = OSUtils::now();
 
-	_ArpEntry &e = _cache[ip];
+	_ArpEntry &e = _cache[targetIp];
 
 	if ( ((e.mac)&&((now - e.lastResponseReceived) >= (ZT_ARP_EXPIRE / 3))) ||
 	     ((!e.mac)&&((now - e.lastQuerySent) >= ZT_ARP_QUERY_INTERVAL)) ) {
@@ -116,9 +116,10 @@ MAC Arp::query(const MAC &localMac,uint32_t ip,void *query,unsigned int &queryLe
 
 		uint8_t *q = reinterpret_cast<uint8_t *>(query);
 		memcpy(q,ARP_REQUEST_HEADER,8); q += 8; // ARP request header information, always the same
-		localMac.copyTo(q,6); q += 6; // sending host address
-		memset(q,0,10); q += 10; // sending IP and target media address are ignored in requests
-		memcpy(q,&ip,4); // target IP address for resolution (IP already in big-endian byte order)
+		localMac.copyTo(q,6); q += 6; // sending host MAC address
+        memcpy(q,&localIp,4); q += 4; // sending host IP (IP already in big-endian byte order)
+		memset(q,0,6); q += 6; // sending zeros for target MAC address as thats what we want to find
+		memcpy(q,&targetIp,4); // target IP address for resolution (IP already in big-endian byte order)
 		queryLen = 28;
 		if (e.mac)
 			queryDest = e.mac; // confirmation query, send directly to address holder

osdep/Arp.hpp

@@ -129,13 +129,14 @@ public:
 	 * MAC returned is non-null.
 	 *
 	 * @param localMac Local MAC address of host interface
-	 * @param ip IP to look up
+     * @param localIp Local IP address of host interface
+	 * @param targetIp IP to look up
 	 * @param query Buffer for generated query -- MUST be a minimum of ZT_ARP_BUF_LENGTH in size
 	 * @param queryLen Length of generated query, or set to 0 if no query generated
 	 * @param queryDest Destination of query, or set to null if no query generated
 	 * @return MAC or 0 if no cached entry for this IP
 	 */
-	MAC query(const MAC &localMac,uint32_t ip,void *query,unsigned int &queryLen,MAC &queryDest);
+	MAC query(const MAC &localMac,uint32_t localIp,uint32_t targetIp,void *query,unsigned int &queryLen,MAC &queryDest);
 
 private:
 	struct _ArpEntry