Okay, it looks like this may work:
The two stations will establish a TCP connection (that is why you are seeing ARPs in the beginning and you might see some BOOTPs and who knows what else. This will probably be unimportant if you only ever have 2 stations). Then the application data then flows through the TCP connection. What I would do in the Windows thingy that replaces your POS:
1) Strip the serial headers off (you have done that I think)
2) Monitor ARPs and TCP handshake process to detect a connection is established between master and slave. From this point, you will have one TCP connection to worry about
3) Monitor one connection e.g. TCP packets between the two and strip off (after stripping off RS85 headers) the TCP and IP headers (make sure to handle repeat packets and acks and so on)
4) After striping off TCP headers you get your raw app data and process it. Basically at this point you should present to your application data processor a contiguous stream of data
In effect you are implementing a small part of TCP/IP stack.
It will help if your two stations establish a permanent TCP connection and just keep it forever - job is easier that way.
And by the way, when you get a chance to see the original designers who arranged it this way in the first place, tell them that you run this past the most reputable software forum in the world and they all though the arrangement sucks big time