Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

NetCut is a software which enables a network admin to turn off the internet connection of any machine in a LAN.
I want to know how it works. It has something to do with spurious ARP packets, however can't seem to find exactly how it works. I am looking for a detailed answer.
Any takers ?

share|improve this question
up vote 4 down vote accepted

I'd guess it's using ARP Spoofing. It won't just limit internet traffic, but all traffic trying to get to that machine. Also, there's a requirement that both machines need to be the same broadcast domain. It's really a broken way to limit internet access, though. If you want do to this the right way, do it at the firewall and/or proxy level.

Additionally, if you really want to figure out what it's doing, just fire up Wireshark, and do a packet capture while you're running the software.

share|improve this answer

I agree with ErikA's points against the use of things like NetCut (+1 there).
As an additional reference, you might want to look at Anti-NetCut2.
It also has some basics in a link called Lessons.

Other references,

  1. NetCut at arcai
  2. Protect Your Computer Against ARP Poison Attack netCut
    Refers AntiARP on a Chinese site (at your risk :)
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.