This read-write INTEGER (enable(1)/disable(2)) turns on a specific set of checks against incoming ARP packets: comparing the source MAC in the Ethernet header against the sender MAC in the ARP body for both requests and responses, comparing the destination MAC against the target MAC in the ARP body for responses, and checking the IP addresses in the ARP body for invalid or unexpected values. An admin cares because these checks catch specific forms of ARP spoofing that a basic IP/MAC binding check alone might miss. For example, an admin concerned about an attacker crafting ARP packets with mismatched Ethernet and ARP-body addresses would enable this validation to have those packets detected and dropped.