I am having some issues at work and there is a new network admin in place. I think I am being monitored so decided to run ArpSpy X in two scenarios:

1. Over WiFi bridge plugged into Cisco router to took a note of the router IP and MAC address. Then I did a vendor look up and it shows as a Cisco router (which it should) but I also have another Mac entry for the same IP (the router IP) of `FF:FF:FF:FF:FF`.
2. Then through Hardwired via Ethernet I only see the `FF:FF....` address for the router IP.

At the moment I only use the network via VPN (OpenVPN) to an external VPN provider to be safe.

Can someone please tell me if the double MAC address via wired and the single `FF:FF:FF....` is normal or am I just being paranoid?