mjhjmtu

I am currently studying about arp spoofing attack (mitm).
Most common linux distributions seems to be by default exposed to these kind of attack.
However, a simple solution seems to set gateway arp entry in static state.

Is there a way with NetworkManager (dispatcher.d) to automatically set a gateway arp entry in static state (or same effect)? Or there is a parameter to set in sysctl.conf avoid arp poisoning? Or maybe another way to achieve this?

Conceptually yes, pinning some MAC addresses is a possible solution (as per @daniel's answer above), but there's many drawbacks to it:

• Whilst you can add static ARP entries, your attacker can still spoof the gateway and your MACs and both systems will parse the attackers' frames;


• If your system is getting its L3 configuration via DHCP, the attacker can attack that to ensure you are using a different gateway, in which case pinning the MAC of the real gateway will make no difference;


• You will struggle to maintain a list of static entries, since all systems will need configuring manually;

I advise you to first test it with:

arp -s router_hostname router_ethernet_addr

where router_ethernet_addr is the MAC address (Ethernet or 802.11) address of your router.
To check on your particular Linux distribution, read:

man arp

When this is OK, I suggest to reject any dynamical adding to your arp table with:

sysctl 'arp_accept=0'
sysctl 'drop_gratuitous_arp=1'

To check this sysntax, read:

man sysctl
man sysctl.conf

Then test to make a fake router reply within your network and check if its Ethernet (or 802.11) address is accepted or not.