I understand that most ARP requests are broadcasted to the entire network. What about ARP replies?Are they sent directly to the host asking for the answer? Or must ARP replies go through the router first? From wireshark,it seems like the ARP replies go directly to the host making the initial ARP request. However, when I try crafting my own packet and sending an ARP reply directly to another host(without the host asking), my destination MAC gets changed automatically to that of the router instead of the MAC of the host I specified.
Perhaps I have misunderstood however- The broadcast domain for a ARP the boundary of the switched network of which each router is a boundary point. So yes replies go direct , no they do not and cannot go through a router . However a router will send a response to a Arp request for an IP address that it has. A proxy arp function exists for some routers and this may be relevant to what you have seen. I'm not sure why the router would change a ARP reply from someone else but without seeing what the data and routing layout I can't be sure what is happening.
Are you trying to force a ARP entry into the ARP table or a device ? Or perhaps you are trying to give an IP address to a device by broadcasting a ARP packet , I remember doing this for some printer servers. I cannot remember the exact details again however the source of the ARP packet it must be on the switched network.
ARP replies are unicast, so only sent to the requestor.
These links may assist: