An attacker on the same office LAN sends forged replies mapping the default gateway's IP address to the attacker's own MAC address. Nearby workstations update their local tables and begin sending their internet-bound traffic to the attacker's machine instead of the router. Which technique is being used, and at which OSI layer does it operate?