A rogue DHCP server or a spoofed ARP reply can take down an entire subnet. DHCP Snooping, DAI, and IP Source Guard are the three security layers that prevent this.