One of the most secure methods of protecting layer two is IP source guard with MAC verification. IP source guard works in conjunction with port security and DHCP snooping to block all ingress traffic not sourced from the IP and MAC recorded in the DHCP snooping database. (This article only discusses IP source guard with MAC verification, port security and option 82 is not necessary if you are not using MAC verification.)