Is it possible to answer ARP requests in user mode instead of inside the kernel?
I can create a
ETH_P_ARP socket but not sure if I can completely replace the kernel strategy at this level.
You can definitely create a socket and use it to respond to ARP requests. That however won't stop the kernel from responding to them.
There are ways to stop the kernel from responding to ARP requests. The simplest and in many cases the best solution is for your program to simply use a different IP address. If the kernel doesn't recognize the IP address it won't respond to ARP requests for it. This method is one I have used myself for implementing a user mode NAT64.
Another way to stop the kernel from responding to ARP requests is through