ARP poisoning, a mainstay of obtaining "man in the middle" position, persists despite advances in computing processing power and memory availability to switch manufacturers. There are however current solutions and theoretical advances in the field which do not require expensive stateful packet analysis.
Cisco Catalyst 6500 series ( http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/white_paper_c11_603839.html ) offers Dynamic ARP Inspection (DAI), a feature which best practice recommends to be enabled, but is not enabled by default. DAI basically utilizes ARP table verification, putting some of the additional memory capacity and processing power to use. The feature, however, depends upon DHCP snooping, thus upon the accuracy of DHCP data. Despite the potential hole exposed by the dependence upon DHCP, DAI is likely to mitigate an even vaster majority of ARP poisoning attacks in the wild as the feature has mitigated in the lab.
Alternative solutions may be developed without the dependence upon DHCP snooping, but employing similar tradeoff analysis. For example, subsequent attempts to associate a MAC with an IP Address can be limited as well as progressively throttled.
The question of how to handle when limit is reached beyond the naive "reject at limit" may call for protocol changes. Protocol changes are, for good, practical reason, not only discouraged but a path taken at one's own peril. The number of devices which implement ARP at the current protocol level is vast. While the devices which we personally operate may be easily patched, patch drift is a reality due to the perceived cost/benefit of remaining up-to-date. Nearly all networking devices utilize firmware so support patching, but patch drift of devices is larger than that of personal computers. Therefore, the parallel support for a proposed version and current versions of the protocol have a real cost that is extremely high. IMHO it is thus best to not employ limiting.
Progressive throttling of ARP while strengthening the certainty of a MAC to IP association would require relatively cheap (no control flow) stateful packet inspection, but would severely limit the window of opportunity and potential for ARP poisoning. Without stateful packet inspection, progressive throttling has opportunity to succeed in preferring the actual addressee over the snooping man in the middle.
Throttling and limiting is just one example of techniques from application layer that may be employed in the networking layer. In the meantime, DAI mitigation success should continue to be enabled as per best practices.
