NetCut is a software which enables a network admin to turn off the internet connection of any machine in a LAN.
I want to know how it works. It has something to do with spurious ARP packets, however can't seem to find exactly how it works. I am looking for a detailed answer.
Any takers ?


I'd guess it's using ARP Spoofing. It won't just limit internet traffic, but all traffic trying to get to that machine. Also, there's a requirement that both machines need to be the same broadcast domain. It's really a broken way to limit internet access, though. If you want do to this the right way, do it at the firewall and/or proxy level.

Additionally, if you really want to figure out what it's doing, just fire up Wireshark, and do a packet capture while you're running the software.


I agree with ErikA's points against the use of things like NetCut (+1 there).
As an additional reference, you might want to look at Anti-NetCut2.
It also has some basics in a link called Lessons.

Other references,

  1. NetCut at arcai
  2. Protect Your Computer Against ARP Poison Attack netCut
    Refers AntiARP on a Chinese site (at your risk :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.