My Windows 2008 server started a TCP session talking to one destination mac address, but in the middle of the TCP session started sending packets to another destination mac address and then eventually switched back. Any thoughts/ideas on what could cause this? Both the sending server and the destination host are on the same subnet. The issue appears to be resolved when I set static ARP entries for the IP on the server.
In this scenario, an attacker would send spoofed ARP replies to both your server and the destination host, poisoning machines' ARP tables and forcing them to send all their traffic through a host of attacker's choice on the local network segment. If that host had IP forwarding (or ethernet bridging) enabled, after it was done with eavesdropping, recording or modifying it, it would route the IP traffic to its final destination without any connectivity loss or whatsoever.
After the completion of the attack, the attacker would send ARP replies with the "legitimate"/initial MAC addresses to the machines that were involved, restoring the ARP table entries, like nothing happened.