16:21 - Wednesday, 23 April 2014

How Does NetCut Work?

#Topics: how does netcut work,how netcut works,what does netcut do

NetCut is a software which enables a network admin to turn off the internet connection of any machine in a LAN.

I want to know how it works. It has something to do with spurious ARP packets, however can’t seem to find exactly how it works. I am looking for a detailed answer.
Any takers ?

I’d guess it’s using ARP Spoofing. It won’t just limit internet traffic, but all traffic trying to get to that machine. Also, there’s a requirement that both machines need to be the same broadcast domain. It’s really a broken way to limit internet access, though. If you want do to this the right way, do it at the firewall and/or proxy level.

Additionally, if you really want to figure out what it’s doing, just fire up Wireshark, and do a packet capture while you’re running the software.

I agree with ErikA’s points against the use of things like NetCut (+1 there).
As an additional reference, you might want to look at Anti-NetCut2.
It also has some basics in a link called Lessons.

Other references,

  1. NetCut at arcai
  2. Protect Your Computer Against ARP Poison Attack netCut
    Refers AntiARP on a Chinese site (at your risk :)