Hi, if you're worried about your internal network, this kind of attack occurs on the switching layer and the traffic does not pass through the firewall before the attack.
i.e. you need to implement protections in the switches.
Conceivably, the IPS or ARPWATCH could alert on suspicious ARP traffic, but could not block it. (You could install ARPWATCH on another internal system.)
Hi, if you're worried about your internal network, this kind of attack occurs on the switching layer and the traffic does not pass through the firewall before the attack.
i.e. you need to implement protections in the switches.
Conceivably, the IPS or ARPWATCH could alert on suspicious ARP traffic, but could not block it. (You could install ARPWATCH on another internal system.)