what can i do to prevent an old user( know my network ip rang ) to connect to my network and make ip scan with program winarpspoofer to know my clients ip and mac

Prevent him from connecting to your network. For wireless use access lists and security profiles.

my network is wired not wireless is there any rule can do this in mikrotik

Use smart switches that can do 802.1x, and always shut all unused ports. Physically secure the switches.

yep, router has nothing to do with the traffic that is not passing through it