diff --git a/sys/net/route.h b/sys/net/route.h
index 506219867ff3..ed43496807f5 100644
--- a/sys/net/route.h
+++ b/sys/net/route.h
@@ -174,6 +174,7 @@ struct ortentry {
 /*			0x100		   unused, was RTF_CLONING */
 #define RTF_XRESOLVE	0x200		/* external daemon resolves name */
 /*			0x400		   unused, was RTF_LLINFO */
+#define RTF_LLDATA	0x400		/* used by apps to add/del L2 entries */
 #define RTF_STATIC	0x800		/* manually added */
 #define RTF_BLACKHOLE	0x1000		/* just discard pkts (during updates) */
 #define RTF_PROTO2	0x4000		/* protocol specific routing flag */
diff --git a/sys/net/rtsock.c b/sys/net/rtsock.c
index 30591c75d3b2..3c1436cd2d64 100644
--- a/sys/net/rtsock.c
+++ b/sys/net/rtsock.c
@@ -53,6 +53,7 @@
 #include <sys/vimage.h>
 
 #include <net/if.h>
+#include <net/if_dl.h>
 #include <net/if_llatbl.h>
 #include <net/netisr.h>
 #include <net/raw_cb.h>
@@ -514,8 +515,10 @@ route_output(struct mbuf *m, struct socket *so)
 		if (info.rti_info[RTAX_GATEWAY] == NULL)
 			senderr(EINVAL);
 		saved_nrt = NULL;
+
 		/* support for new ARP code */
-		if (info.rti_info[RTAX_GATEWAY]->sa_family == AF_LINK) {
+		if (info.rti_info[RTAX_GATEWAY]->sa_family == AF_LINK &&
+		    (rtm->rtm_flags & RTF_LLDATA) != 0) {
 			error = lla_rt_output(rtm, &info);
 			break;
 		}
@@ -535,7 +538,8 @@ route_output(struct mbuf *m, struct socket *so)
 		saved_nrt = NULL;
 		/* support for new ARP code */
 		if (info.rti_info[RTAX_GATEWAY] && 
-		    (info.rti_info[RTAX_GATEWAY]->sa_family == AF_LINK)) {
+		    (info.rti_info[RTAX_GATEWAY]->sa_family == AF_LINK) &&
+		    (rtm->rtm_flags & RTF_LLDATA) != 0) {
 			error = lla_rt_output(rtm, &info);
 			break;
 		}
@@ -1427,6 +1431,21 @@ sysctl_rtsock(SYSCTL_HANDLER_ARGS)
 			lim = AF_MAX;
 		} else				/* dump only one table */
 			i = lim = af;
+
+		/*
+		 * take care of llinfo entries, the caller must
+		 * specify an AF
+		 */
+		if (w.w_op == NET_RT_FLAGS && w.w_arg == 0) {
+			if (af != 0)
+				error = lltable_sysctl_dumparp(af, w.w_req);
+			else
+				error = EINVAL;
+			break;
+		}
+		/*
+		 * take care of routing entries
+		 */
 		for (error = 0; error == 0 && i <= lim; i++)
 			if ((rnh = V_rt_tables[curthread->td_proc->p_fibnum][i]) != NULL) {
 				RADIX_NODE_HEAD_LOCK(rnh); 
@@ -1435,11 +1454,6 @@ sysctl_rtsock(SYSCTL_HANDLER_ARGS)
 				RADIX_NODE_HEAD_UNLOCK(rnh);
 			} else if (af != 0)
 				error = EAFNOSUPPORT;
-		/*
-		 * take care of llinfo entries
-		 */
-		if (w.w_op == NET_RT_FLAGS)
-			error = lltable_sysctl_dumparp(af, w.w_req);
 		break;
 
 	case NET_RT_IFLIST:
diff --git a/sys/netinet/in.c b/sys/netinet/in.c
index 94535b108bcf..3f11e82d6c95 100644
--- a/sys/netinet/in.c
+++ b/sys/netinet/in.c
@@ -1222,7 +1222,7 @@ in_lltable_dump(struct lltable *llt, struct sysctl_req *wr)
 
 			arpc.rtm.rtm_rmx.rmx_expire =
 			    lle->la_flags & LLE_STATIC ? 0 : lle->la_expire;
-			arpc.rtm.rtm_flags |= RTF_HOST;
+			arpc.rtm.rtm_flags |= (RTF_HOST | RTF_LLDATA);
 			if (lle->la_flags & LLE_STATIC)
 				arpc.rtm.rtm_flags |= RTF_STATIC;
 			arpc.rtm.rtm_index = ifp->if_index;
diff --git a/sys/netinet6/in6.c b/sys/netinet6/in6.c
index ee061994920e..0d0c951a7d0e 100644
--- a/sys/netinet6/in6.c
+++ b/sys/netinet6/in6.c
@@ -2282,7 +2282,7 @@ in6_lltable_dump(struct lltable *llt, struct sysctl_req *wr)
 			bcopy(&lle->ll_addr, LLADDR(sdl), ifp->if_addrlen);
 			ndpc.rtm.rtm_rmx.rmx_expire =
 			    lle->la_flags & LLE_STATIC ? 0 : lle->la_expire;
-			ndpc.rtm.rtm_flags |= RTF_HOST;
+			ndpc.rtm.rtm_flags |= (RTF_HOST | RTF_LLDATA);
 			if (lle->la_flags & LLE_STATIC)
 				ndpc.rtm.rtm_flags |= RTF_STATIC;
 			ndpc.rtm.rtm_index = ifp->if_index;
diff --git a/usr.sbin/arp/arp.c b/usr.sbin/arp/arp.c
index ab3587cf7f02..f99cf0f89350 100644
--- a/usr.sbin/arp/arp.c
+++ b/usr.sbin/arp/arp.c
@@ -477,6 +477,7 @@ delete(char *host, int do_proxy)
 		}
 		dst->sin_other = SIN_PROXY;
 	}
+	rtm->rtm_flags |= RTF_LLDATA;
 	if (rtmsg(RTM_DELETE, dst, NULL) != NULL) {
 		printf("%s (%s) deleted\n", host, inet_ntoa(addr->sin_addr));
 		return (0);
@@ -706,7 +707,7 @@ rtmsg(int cmd, struct sockaddr_inarp *dst, struct sockaddr_dl *sdl)
 		rtm->rtm_addrs |= RTA_GATEWAY;
 		rtm->rtm_rmx.rmx_expire = expire_time;
 		rtm->rtm_inits = RTV_EXPIRE;
-		rtm->rtm_flags |= (RTF_HOST | RTF_STATIC);
+		rtm->rtm_flags |= (RTF_HOST | RTF_STATIC | RTF_LLDATA);
 		dst->sin_other = 0;
 		if (doing_proxy) {
 			if (proxy_only)
diff --git a/usr.sbin/ndp/ndp.c b/usr.sbin/ndp/ndp.c
index a158fb28e19d..570961a3e9f9 100644
--- a/usr.sbin/ndp/ndp.c
+++ b/usr.sbin/ndp/ndp.c
@@ -554,6 +554,7 @@ delete:
          * but we want the actual address
          */
 	NEXTADDR(RTA_DST, sin_m);
+	rtm->rtm_flags |= RTF_LLDATA;
 	if (rtmsg(RTM_DELETE) == 0) {
 		struct sockaddr_in6 s6 = *sin; /* XXX: for safety */
 
@@ -895,7 +896,7 @@ rtmsg(cmd)
 			rtm->rtm_rmx.rmx_expire = expire_time;
 			rtm->rtm_inits = RTV_EXPIRE;
 		}
-		rtm->rtm_flags |= (RTF_HOST | RTF_STATIC);
+		rtm->rtm_flags |= (RTF_HOST | RTF_STATIC | RTF_LLDATA);
 #if 0 /* we don't support ipv6addr/128 type proxying */
 		if (rtm->rtm_flags & RTF_ANNOUNCE) {
 			rtm->rtm_flags &= ~RTF_HOST;