I consider this to be an embarrassing property of modern networking. A network switch that tracks and enforces the mapping between addresses and ports, blocks

I consider this to be an embarrassing property of modern networking. A network switch that tracks and enforces the mapping between addresses and ports, blocks spoofed packets, ensures fair allocation of DHCP leases, and enforces fair allocation of bandwidth out to be available out of the box from any credible vendor. None of this is conceptually difficult, and all the building blocks are available in somewhat standardized form. But for some reason, port security is an exotic enterprise-y set of features rather than something one can deploy out of the box. Or an NVR deployment could use 802.1BR to isolate all the cameras. I’m a firm believer in endpoint security — endpoints should not need to trust the network for authentication or authorization when communicating with each other. But the network really ought to be able to do its job despite attacks by rogue endpoints or someone compromising a single piece of network infrastructure, and the network’s job is to maintain reliable connectivity.