and an obvious question ... that I forgot to ask...

What is the MAC address listed for this IP address?

MAC address listed for the ip address is 00-14-F6-67-C8-7E

After running net analyzer traceroute at step 4 it gives me 31.55.186.188 which comes back as BT so I think panic over.
inetnum: 31.55.184.0 - 31.55.187.255
netname: BT-21CN-TMAN-V2
descr: BT-21CN-TMAN-V2
country: GB
admin-c: BR2649-RIPE
tech-c: BR2649-RIPE
status: ASSIGNED PA
remarks: Please send abuse notification to abuse@bt.net
remarks: INFRA-AW
mnt-by: BTNET-MNT
mnt-lower: BTNET-MNT
mnt-routes: BTNET-MNT
created: 2013-08-16T08:40:35Z
last-modified: 2013-08-16T08:40:35Z
source: RIPE

role: BT RAM
address: BT
address: UK
admin-c: AA12126-RIPE
tech-c: AA12126-RIPE
nic-hdl: BR2649-RIPE
mnt-by: BTNET-MNT
created: 2012-04-10T15:28:46Z
last-modified: 2012-04-10T15:28:46Z
source: RIPE # Filtered

% Information related to '31.48.0.0/13AS2856'

route: 31.48.0.0/13
descr: BT Public Internet Service
origin: AS2856
mnt-by: BTNET-INFRA-MNT
created: 2011-02-11T10:32:17Z
last-modified: 2014-07-30T09:04:12Z
source: RIPE # Filtered

%

thedunk73 wrote: MAC address listed for the ip address is 00-14-F6-67-C8-7E

FWIW - that's Juniper Networks.

thedunk73 wrote: After running net analyzer traceroute at step 4 it gives me 31.55.186.188 which comes back as BT so I think panic over.
inetnum: 31.55.184.0 - 31.55.187.255
netname: BT-21CN-TMAN-V2

OK, now I'm confused

That IP is BT - but it's not the one you orginally quoted. Also, what is "Step 4" ? :?:

When I run network analyzer it lists my router in first 192.168.0.1 2.4ms then lists 31.55.186.181 in 14ms and now list 31.55.186.188 in 14.3ms. The steps is just where it appears in the list.. But both return as BT so I now presume this normal...

thedunk73 wrote: The steps is just where it appears in the list.. But both return as BT so I now presume this normal...

Ah, OK - I'm with you now

The Traceroute stuff all looks perfectly normal - but it's unrelated to your observation about the Vigor 130's ARP cache. When you're communicating with the Internet from your PC, the Vigor 130 is transparent- because it's acting at a lower level than IP ... i.e. as a modem.

The more I think about it, that entry in the 130's ARP cache has either been added as a static entry by the Vigor 130 - or some attempt to access 30.19.160.1 has been made - again from the Vigor 130 itself. I don't think such an attempt is likely to succeed anyway, since the Vigor 130 doesn't have a public IP address - it would have to NAT back via the Router (which probably wouldn't allow that from its WAN port).

In any case, neither of those two scenarios seem even faintly likely ...
...perhaps someone more knowledgeable about the Vigor 130 can figure it out (Draytek? :wink: )