I did a new cdrom install and ran Iptraf on an internal slack machine. 
Immediatly I noticed incoming NON-IP packets coming from this mac address
eth.src == 00:40:f4:11:71:b6 . This was confirmed by ethereal. Does monowall
block mac's or non-ip? I've taken alook at all my mac addresses and the above 
mac is not within my network configuration.