I was trying to hide my laptop from my phone's network scan app. The app is using arp requests to find devices on the network. I tried everything on iptables. It doesn't work, even if i set all the policies drop. Fortunately arptables can drop the requests. But why iptables can't do that ?
ARP and TCP/IP are different layers in the networking technology stack. If you have read about the OSI model, that applies here.
ARP is a protocol at layer 2 dealing with connecting the host to the local network.
TCP/IP are protocols dealing with connecting networks together.
iptables deals (mostly) with TCP/IP and higher layers.
arptables deals with the ARP layer.
Because iptables deals with TCP/IP. ARP is not TCP/IP.
You can install
arptables, and use that for filtering arp requests. On a debian-related distro
sudo apt install arptables should do the trick.
Then you can do
arptables -A INPUT --source-mac de:ad:be:ef:ba:be -j DROP
and so forth.
man arptables will give you a full overview.