During a network attack investigation, a defender observes that an attacker is sending forged ARP replies to associate the attacker's MAC address with the default gateway's IP so that traffic is intercepted. Which countermeasure activity from the curriculum directly addresses recognizing this attack?