I'm more interested to know about the endpoint that was responding to all IPs.

Also, minor nitpick:

> Without that we would have been reduced to tracing through switch ARP tables (for switches smart enough to report that)

You'd only need your switch to have a viewable mac address table rather than an ARP table.