Which technology supports antispoofing and does not have any impact on encryption performance regardless of packet size?

MACsec (IEEE 802.1AE) is a Layer 2 hop-by-hop encryption standard that provides confidentiality, data integrity, and protection against replay and spoofing attacks on Ethernet links. Its encryption engine is implemented in dedicated hardware ASICs built into network interface cards and switches, which process frames at line rate independent of frame size. This hardware offload means there is zero CPU involvement and no performance degradation whether packets are 64 bytes or 9000 bytes, unlike software-based encryption schemes.

IP Source Guard prevents IP address spoofing by binding traffic to DHCP-assigned IP-to-MAC mappings, but it involves no encryption whatsoever, making encryption performance irrelevant to it.

DHCP snooping combined with Dynamic ARP Inspection (DAI) mitigates ARP and DHCP spoofing at Layer 2, but neither technology performs encryption, so they cannot satisfy the encryption performance requirement.

IPsec performs Layer 3 encryption that is often software-assisted or uses general-purpose processors, introducing per-packet overhead that disproportionately impacts small packets and causes performance to vary significantly with packet size.