On Mon, 23 Oct 2023, Jack Haverty via Nnagain wrote:

> We discovered that most computers simply believed the latest ARP information 
> it received.   So it was easy for the Flakeway to insert itself into any IP 
> traffic flow and do its work, without any changes to software in any other 
> computer.  It was handy not only for testing but also for diagnosing all 
> sorts of problems, simply capturing the traffic flows for later analysis 
> (similar to wireshark).
>
> That was all done in the IPV4 world, 40+ years ago, so I'm not sure how it 
> might relate to today's Internet.   We reported this "feature" to IETF and 
> some IEEE 802.x committee as a likely vulnerability, but I'm not sure if 
> anything changed.

This is commonly used today for failover/load balancing

David Lang