I recently started picking up some weird entries in my firewall log:
kernel: arplookup 26.XXX.XXX.XXX failed: host is not on local network
There are at least at dozen entries, all to different IP's within DISANET26.
I couldn't help but be curious as to what was going on so I fired up Wireshark and began capturing packets to try and find out where it was coming from.
Turns out it's my brand new HTC sensation with all but a handful of apps installed (standard google apps + other apps I've used in the past) - I don't even have it rooted yet.
Wireshark shows a Broadcast ARP packet coming from the sensation's mac address, but logs it as coming from the DoD IP in question. The target is the gateway (pfsense router).
I've found a similar discussion over at the tmobile forums with no official tmobile response: http://forums.t-mobile.com/t5/Help-General-Discussion/Hiport-connects-to-DoD/td-p/205863
I doubt I'll find someone at tmobile who will have a clue what I'm talking about but whether the DoD is involved or not there's no denying that the phone is trying to send these packets to them.
I won't sleep well until I know why.