This Counter64, in ARP Responses, counts spoofed ARP responses received by the firewall, meaning an ARP response mapped an IP address to a different MAC address than the one already in the firewall's local ARP cache, accumulated since the last reboot. An admin uses this as a direct security signal for ARP spoofing or man-in-the-middle attempts on the local segment. A sudden burst of spoofed responses tied to a specific IP address would point an admin toward investigating a possible ARP poisoning attack targeting that host.