For anyone being notified of ARP Cache Poisoning attacked on their network originating from a Roku Ultra on their network, I believe I have troubleshooted and solved the issue.
I was receiving multiple ARP Cache Poisoning attack notifications on my network that were being blocked by my network security. Often over 30 such events in 1 day and there may be an accompanying singular notification stating Duplicate IP addresses on network that points back to the same IP address of the Roku Ultra. The source and target of the attack were the same IP address of my Roku but the MAC addresses were not the same (differed by 1 digit).
This is what I have found that I believe was the source and resolution to the issue. The Roku Ultra has both an ethernet adapter and wireless adapter. They apparently each have their own unique MAC address but may only differ by 1 digit as in my case. At one time I had my Roku connected wirelessly but then hard wired it to ethernet port. The Roku wireless adapter would still be active and sometimes override the ethernet, even while hooked up by ethernet.
I reset (cleared) the wireless network settings on the Roku so that it could not connect wirelessly and my Roku is connected by ethernet. I do not expect any more notifications. If I do receive additional notifications, then that would mean the Roku is waking up the wireless adapter and trying to access my network even though it does not have the settings stored to access my Wifi.
Hope this helps somebody and hope Roku addresses the issue in a future firmware update so that the Roku Ultra cannot be seen as 2 separate devices on the network sharing the same IP address or creating ARP Cache Poisoning attack notifications on the network. (This is in my opinion a flaw with the Roku firmware and appears to have started occurring after a recent firmware update because I only noticed the attack notifications at starting to occur recently within the last couple weeks. Many devices such as computers have both ethernet and wireless adapters and when connected by ethernet should deactivate the wireless adapter otherwise can create stability and connectivity issues). In my case, I saw that Roku connection was wireless even though also connected by ethernet.
