How does NetCut work?

Question

NetCut is a software which enables a network admin to turn off the internet connection of any machine in a LAN.
I want to know how it works. It has something to do with spurious ARP packets, however can't seem to find exactly how it works. I am looking for a detailed answer.
Any takers ?

Answer 1

I'd guess it's using ARP Spoofing. It won't just limit internet traffic, but all traffic trying to get to that machine. Also, there's a requirement that both machines need to be the same broadcast domain. It's really a broken way to limit internet access, though. If you want do to this the right way, do it at the firewall and/or proxy level.

Additionally, if you really want to figure out what it's doing, just fire up Wireshark, and do a packet capture while you're running the software.

Answer 2

I agree with ErikA's points against the use of things like NetCut (+1 there).
As an additional reference, you might want to look at Anti-NetCut2.
It also has some basics in a link called Lessons.

Other references,

1. NetCut at arcai
2. Protect Your Computer Against ARP Poison Attack netCut
   Refers AntiARP on a Chinese site (at your risk :)