Filter out ARP query from given ether:ip Let's say on my network there is a hacker who floods my computer with arp messages to associate his MAC address with the IP of the computer I want to reach.

It's like he sends the following message continuously (100 packets per second) to my computer:

192.168.1.2 (my target) has 0:0:0:0:0:1 (hacker's MAC address)


the following does not work, I end up with the two association in arp -a:

arp -a -d; arp -s 192.168.1.2 0:0:0:0:0:2 (the real MAC address of the target)


Is it possible on macOS to  drop the arp packets from the hacker?
You could use a static ARP entry to solve the problem. This is done using "arp -s" as you write in your question. The second association is not a problem as the static entry will take precedence.

Alternatively you could block the MAC address of the spoofer. For example you could use the "ifconfig bridge" command to create a bridge over which you tunnel all packets from the evil MAC-address. When configuring the bridge, set that it tags the packets.

Then you can use the pf packet filter to examine all the tagged packets and possible reject them.