diff --git a/net_alerter/net_alerter.py b/net_alerter/net_alerter.py
index c41a4b5..9ddc1ce 100644
--- a/net_alerter/net_alerter.py
+++ b/net_alerter/net_alerter.py
@@ -1540,7 +1540,11 @@ def parse_frame(data: bytes) -> None:
         
         # Branch A: ARP frame (ethertype 0x0806)
         if eth_type == 0x0806:
-            _update_last_seen(src_mac)
+            # Only ARP requests (opcode 1) are genuine device-originated signals.
+            # ARP replies (opcode 2) may be AP ARP proxy forgeries: the AP answers
+            # on behalf of disconnected clients with the client MAC as Ethernet source.
+            if len(data) >= 22 and struct.unpack('!H', data[20:22])[0] == 1:
+                _update_last_seen(src_mac)
             # Ingest ARP signal for multi-source device identity
             _ingest_signal(src_mac, 'arp')
             return