SPI can only do so much. Inbound it will handel not outboad. Windows Firewall is like SPI in that sense. You need a product that blocks gratuitous ARP frames, protect the ARP cache and can anylize the protocol's. If only the feds took this approach...