At least a partial solution.  It seems that if my monitoring
program is running, the duplicate pings show up on m0n0wall.

[OPT1] -- [switch] -- [m0n0] -- [hub] -- [router] -- [Internet]
[LAN]------------------/

As I mentioned in the text of my previous message, the hub in my drawing
was for running a traffic monitor.  The monitor is running on a Windows
box, and the monitor puts its NIC into promiscuous mode to see all the
packets.  I'm guessing this is causing responses in such a way that m0n0
is seeing them as duplicate packets from the pinged hosts. 
Interestingly these duplicate packets don't show up when pinging from
any of the Windows PCs...anyone know if Windows' ping reports those?  I
have no idea why this program would be responding to anything, but I
will ask the author and report back.

 - Steve Yates
 - ITS, Inc.
 - When you get there, there's no there there.

~ Taglines by Taglinator 4 - www.srtware.com ~