If your linux box already recently seen traffic from that device (say, mac is 00:07:E9:62:8F:F3), it will have its mac/ip in the arp cache.