Quick question .... on the 2820, in the ARP Cache table, is the router just sniffing the network and displaying items its found, or are the entries in the ARP table making a connection over the router???

thanks!

Every time the router needs to do an ARP request it will cache the response, to save needing to do it again. Most ARP systems then expire old entries on time since last use basis. So just because there is an entry in the table, it does not mean there is a live connection to that address at that moment.

(the NAT Session table will give you a better indication of that, as would doing "netstat -a" at the windows command prompt of any machine you are interested in its connection status)