An Empirical Study on Layer-2 Station Isolation Deficits and Asymmetric Evasion Thresholds in Wireless Broadcast Domains

Wireless Local Area Networks (WLANs) deployed in small-to-medium enterprise (SME) and Customer Premises Equipment (CPE) environments frequently operate under an unsegmented "flat" network architecture. While transport-layer encryption (TLS 1.3) has become standard, the data link layer (Layer 2) remains fundamentally dependent on the stateless, unauthenticated Address Resolution Protocol (RFC 826). This paper investigates the empirical security posture of WLANs lacking Access Point (AP) Station Isolation. Beyond demonstrating basic Layer-2 manipulation, this study formulates and evaluates an asymmetric evasion hypothesis: identifying the frame injection frequency boundary where an attacker reliably sustains ARP cache poisoning on commodity client endpoints while remaining undetected by default threshold-based intrusion detection systems (NIDS). Through a multi-trial controlled testbed comparing disparate hardware deployments (TP-Link 802.11n infrastructure and Huawei GPON optical network terminals), we evaluate injection frequencies ranging from 0.2 Hz to 5.0 Hz across N = 3 repeated runs per condition (480 discrete checkpoint measurements per condition, totaling 2,400 checkpoints across five evaluation trials). Our findings demonstrate that low-frequency injection at 0.5 Hz (2.0-second interval) achieves 99.4% ± 0.6% cache retention across modern client endpoints while completely evading standard sliding-window rate-anomaly thresholds in Suricata 7.0 (sid:1000001). Furthermore, we analyze the operational divergence between rate-based detection and state-based inspection: while Zeek 6.0's stateful notice (ARP::Duplicate_IP_MAC) flags conflicts on the initial frame, it is routinely omitted in default production sensor deployments due to state table memory scaling and false-positive churn caused by mobile MAC address randomization. We quantitatively analyze a captured session of 1,200 redirected frames across TCP and UDP transport protocols, evaluate the intelligence leakage of flow metadata mapped to Autonomous System (AS) providers, and outline an architectural remediation framework incorporating Private VLANs, Dynamic ARP Inspection (DAI), and IEEE 802.11w Protected Management Frames.