From: "Ethan S." <dragon788 at gmail dot com>

> Oct 9 09:26:57 m0n0wall /kernel: arplookup 10.1.1.1 failed: host is not on
> local network
> Oct 9 09:27:37 m0n0wall last message repeated 2 times
> Oct 9 09:29:37 m0n0wall last message repeated 6 times
> Oct 9 09:39:37 m0n0wall last message repeated 30 times
> Oct 9 09:49:37 m0n0wall last message repeated 30 times

> I keep seeing this over and over in my logs. Would this have anything to 
> do
> with DHCP from my ISP? The IP I get isn't in the private range and I use a
> 192.168 range on my internal network, I really can't figure out where this
> arp is coming from but it usually occurs after the router makes a DHCP
> request and gets an ack back.

Someone with a 10.1.1.1 IP address is on your LAN trying to get out. 
Usually a vendor or consultant with a hard coded IP address.

                                Lee