Mitigating Man-in-the-Middle Attacks

Implement kernel policies to detect and drop suspicious ARP/NDP advertisements.

In this lesson, you will learn how to harden your network stack against Man-in-the-Middle (MitM) attacks by implementing kernel-level policies that validate Address Resolution Protocol (ARP) and Neighbor Discovery Protocol (NDP) traffic.

The Problem: Spoofed Responses

At the data link layer, systems rely on ARP (IPv4) or NDP (IPv6) to map IP addresses to physical MAC addresses. Because these protocols are stateless and trust broadcasted messages, an attacker can send "gratuitous" ARP replies—essentially lying to the network by claiming their MAC address belongs to the default gateway. Once the victim updates their ARP cache, their traffic flows through the attacker's machine, enabling interception.

Mitigating via Kernel Policies

We can mitigate these attacks by tuning kernel parameters to enforce strict validation of incoming advertisements. Instead of accepting any mapping that arrives, we instruct the kernel to verify that the IP-to-MAC mapping is already associated with the interface or belongs to a known neighbor.

You can configure these strict ARP policies via sysctl:

# Force strict ARP filtering
sysctl -w net.ipv4.conf.all.arp_ignore=1
sysctl -w net.ipv4.conf.all.arp_announce=2

arp_ignore=1: The kernel will only answer an ARP request if the requested IP address is configured on the incoming interface.
arp_announce=2: The kernel will always prefer the most appropriate local address for the subnet, preventing the leakage of information about other interfaces.

Securing IPv6 with NDP

For IPv6, NDP is susceptible to similar redirection attacks. We can harden this by requiring "secure" neighbor discovery or, at the minimum, preventing the kernel from automatically accepting unsolicited advertisements. You can force the kernel to ignore unsolicited neighbor advertisements:

# Prevent unsolicited NDP updates
sysctl -w net.ipv6.conf.all.accept_unsolicited_na=0

By restricting how the kernel populates its neighbor tables, you reduce the attack surface for cache poisoning. In a production environment, this should be paired with ebtables or nftables rules that explicitly filter unauthorized MAC-to-IP pairings if your network topology remains static.

Key Takeaway: By tightening kernel ARP/NDP policies, you force the system to ignore unsolicited or invalid network mapping requests, effectively neutering common local MitM redirection techniques.