davidsonrafaelk/evillimiterTool that monitors, analyzes and limits the bandwidth of devices on the local network without administrative access
This project is a maintained fork of bitbrute/evillimiter. The upstream repository is no longer maintained, so this fork continues development - bug fixes, new features, and compatibility updates. See Fork-specific changes below.
A tool to monitor, analyze and limit the bandwidth (upload/download) of devices on your local network without physical or administrative access.
evillimiter employs ARP spoofing and traffic shaping to throttle the bandwidth of hosts on the network. On IPv6-enabled networks, NDP spoofing is used alongside ARP spoofing to also cut off a host's IPv6 traffic, which would otherwise bypass the IPv4-only limit/block.
Searching for a Windows-compatible version?
Check out the open-source alternative EvilLimiter for Windows.
Only run this against a network you own or have written permission to test. ARP and NDP spoofing disrupts other people's traffic by design, and doing it to a network you don't control is illegal in most places.
Possibly missing python packages will be installed during the installation process.
evillimiter locates tc, iptables and sysctl via PATH at startup and errors clearly if one is missing. It shells out to the iptables binary specifically - on distros where iptables is an iptables-nft compatibility shim this generally works, but a firewall managed purely through native nft rules with no iptables shim installed is not something this tool talks to.
git clone https://github.com/DavidsonRafaelK/evillimiter.git
cd evillimiter
python3 -m venv .venv
source .venv/bin/activate
pip install .
Run it with sudo (raw sockets, iptables/tc need root) - it's the run that needs root, not the install:
sudo .venv/bin/evillimiter
Note: sudo python3 setup.py install (the old instructions) is deprecated in modern setuptools and often fails outright with ModuleNotFoundError: No module named 'setuptools' - sudo runs the system Python, which usually doesn't have setuptools installed, unlike the venv's own Python that pip manages for you. On distros that enforce PEP 668 (Arch, Debian 12+, ...), installing outside a venv is blocked entirely for this reason.
Alternatively, you can download a desired version from the Release page.
Type evillimiter or python3 bin/evillimiter to run the tool.
evillimiter will try to resolve required information (network interface, netmask, gateway address, ...) on its own, automatically.
| Argument | Explanation |
|---|---|
-h | Displays help message listing all command-line arguments |
-i [Interface Name] | Specifies network interface (resolved if not specified) |
-g [Gateway IP Address] | Specifies gateway IP address (resolved if not specified) |
-m [Gateway MAC Address] | Specifies gateway MAC address (resolved if not specified) |
-n [Netmask Address] | Specifies netmask (resolved if not specified) |
-f | Flushes current iptables and tc configuration. Ensures that packets are dealt with correctly. |
--colorless | Disables colored output |
-l [File Path], --log-file [File Path] | Also appends every ok/error message to this file (plain text, no color codes). |
--version | Prints the installed version and exits. |
Any of the flags above (except -f/--flush, which is a one-shot action, not a persisted preference) can be given a default in an optional ini file at ~/.config/evillimiter/config.ini (or $XDG_CONFIG_HOME/evillimiter/config.ini). A command-line flag always overrides the config file.
[general]
interface = wlan0
colorless = true
auto_scan = true
log_file = /var/log/evillimiter.log
[watch]
interval = 30
range = 192.168.1.1-192.168.1.50
[watch] sets the initial values normally set at runtime via watch set interval/watch set range (see below), so they don't need to be re-entered every session.
auto_scan (opt-in, off by default) runs scan then hosts automatically right after startup, so you don't have to type them every session.
evillimiter Commands