Identify the mechanism
ARP poisoning lies about the IP-to-MAC mapping. DNS poisoning supplies a false name answer. A rogue DHCP server gives clients dangerous configuration. An evil twin imitates a trusted wireless network. MAC flooding attempts to overwhelm a switch's learned table. Name the mechanism before selecting a control.
Layer controls
Disable unused ports, change default credentials, use least privilege, segment guests, protect management access and keep firmware current. Port security and 802.1X restrict who can use a switch port. WPA2 or WPA3 protects wireless access, but a password alone does not replace segmentation or patching.
Rules are evaluated deliberately
An ACL or firewall policy commonly evaluates rules from top to bottom and stops at the first match. Put specific exceptions before broad rules, document the intent, and verify both allowed and denied traffic. A default deny is safer only when required traffic has been explicitly allowed.
Contain, preserve, recover
When suspicious traffic is found, preserve useful evidence, scope the impact, contain the affected segment, remove the cause, restore safely and document lessons learned. Do not destroy the only packet capture or change the system blindly while investigating.