> Could someone explain this behaviour? > > When an IP address is assigned to a bridge member interface, an arp > broadcast request to this interface bypasses bridge filter rules. But, an > arp unicast request is blocked as it should.
If you can, it might be helpful to confirm this somewhere other than with vmware virtual nics, just to rule out the possibility of vmware's networking doing something unexpected. If you must use vmware, maybe you could try USB nics and have them attach to the VM via the virtual-USB instead.
