diff --git a/node/Membership.cpp b/node/Membership.cpp
index d9fa5945d..a60b86beb 100644
--- a/node/Membership.cpp
+++ b/node/Membership.cpp
@@ -240,7 +240,6 @@ Membership::AddCredentialResult Membership::addCredential(const RuntimeEnvironme
 	}
 }
 
-
 Membership::AddCredentialResult Membership::addCredential(const RuntimeEnvironment *RR,const NetworkConfig &nconf,const CertificateOfOwnership &coo)
 {
 	_RemoteCredential<CertificateOfOwnership> *const *htmp = std::lower_bound(&(_remoteCoos[0]),&(_remoteCoos[ZT_MAX_CERTIFICATES_OF_OWNERSHIP]),(uint64_t)coo.id(),_RemoteCredentialComp<CertificateOfOwnership>());
diff --git a/node/Network.cpp b/node/Network.cpp
index f227d0360..645ae67c7 100644
--- a/node/Network.cpp
+++ b/node/Network.cpp
@@ -515,6 +515,8 @@ static _doZtFilterResult _doZtFilter(
 						src.set((const void *)(frameData + 12),4,0);
 					} else if ((etherType == ZT_ETHERTYPE_IPV6)&&(frameLen >= 40)) {
 						src.set((const void *)(frameData + 8),16,0);
+					} else if ((etherType == ZT_ETHERTYPE_ARP)&&(frameLen >= 28)) {
+						src.set((const void *)(frameData + 14),4,0);
 					}
 					if (inbound) {
 						if (membership) {
diff --git a/node/OutboundMulticast.cpp b/node/OutboundMulticast.cpp
index 2f6bf986e..36dc41f43 100644
--- a/node/OutboundMulticast.cpp
+++ b/node/OutboundMulticast.cpp
@@ -88,7 +88,7 @@ void OutboundMulticast::init(
 void OutboundMulticast::sendOnly(const RuntimeEnvironment *RR,const Address &toAddr)
 {
 	const SharedPtr<Network> nw(RR->node->network(_nwid));
-	Address toAddr2(toAddr);
+	const Address toAddr2(toAddr);
 	if ((nw)&&(nw->filterOutgoingPacket(true,RR->identity.address(),toAddr2,_macSrc,_macDest,_frameData,_frameLen,_etherType,0))) {
 		//TRACE(">>MC %.16llx -> %s",(unsigned long long)this,toAddr.toString().c_str());
 		_packet.newInitializationVector();