First of all, you should switch to Wireshark ASAP. We renamed the project in May 2006, and have fixed lots of bugs since then.40% ARP traffic sounds pretty excessive. As ohassairi and Kevin Dorrell pointed out, this could be a by-product of scanning...
Please be aware that we renamed Ethereal to Wireshark in May 2006: http://www.wireshark.orgEthereal hasn't been under active development since then, and the site recommends upgrading to Wireshark: http://www.ethereal.com/appnotes/enpa-sa-00024.html
Ethereal (which has been renamed to Wireshark) captures in promiscuous mode by default, meaning that it will bring in all traffic that hits the NIC. Something you might want to look into is why traffic for 10.1.2.1 and 10.1.2.2 are hitting your port....
Please be aware that Ethereal changed its name to Wireshark (http://www.wireshark.org/) in May 2006. According to the latest Ethereal security advisory, you should upgrade to Wireshark: http://www.ethereal.com/appnotes/enpa-sa-00024.html
