I am studying network security.
I am wondering about ARP Spoofing. As you know ARP and ICMP only work at Layer 3 (network). But ARP spoofing attacks layer 2 (data link: mac address table).
I don't understand the problem.
From this answer, ARP is layer 2 packet. Also from Wiki you can find this:
The Address Resolution Protocol is a request and response protocol whose messages are encapsulated by a link layer protocol
You might be confused because of OSI model. However, ARP was not developed in the OSI networking framework.