ArpCut
An ARP spoofing-based LAN disconnection tool (requires Root).
Continuously sends forged ARP replies to LAN devices to cut off their network connections, and provides device identification, notes, whitelist, and operation records.
Project Homepage
Feature Overview
- LAN device scanning (root scan, auto-refresh every 5 seconds, automatic identification of IP / MAC / local device / gateway).
- Per-device "Disconnect / Restore" toggle, plus "Disconnect All" / "Restore All" batch operations.
- Full IEEE OUI vendor identification (54,330 entries, built-in offline) and randomized MAC (privacy protection) detection.
- Device notes, whitelist, search, and sorting by IP / note / disconnected / not disconnected.
- Disconnect and restore operation records, with optional persistent attack.
- Colorful flowing light background, liquid glass floating bottom bar, miuix / InstallerX Revived style interface.
Main Features
Device Scanning
- Root scan of LAN devices, displaying IP / MAC.
- Local device and gateway are automatically identified and labeled; the local device is always pinned to the top.
- Auto-refreshes every 5 seconds, fully silent with no flickering.
- Shows an empty-state prompt when not connected to Wi-Fi.
Disconnect Control
- Per-device toggle: continuously sends forged ARP replies to the target device, broadcasting GARP poisoning at 1s intervals.
- "Disconnect All": disconnects all devices except the local device and whitelisted devices with one tap.
- "Restore All": terminates the attack loop, restores the neighbor table, and triggers re-resolution.
- Self-disconnect support: poisons the local device's neighbor table to cut the local device off the network as well.
Device Details and Identification
- Tap the blank area of a card to expand details: vendor / device type / latency / whitelist / recent records.
- OUI data comes from the official IEEE MA-L / MA-M / MA-S full database, queried offline.
- Randomized MAC (privacy protection) is automatically identified and labeled.
Notes and Whitelist
- Tap the IP to open an edit dialog; notes are persistently displayed as blue tags.
- Notes are sorted to the front; the whitelist can be toggled within the dialog, and whitelisted devices are skipped during "Disconnect All".
Records
- Disconnect / restore operations are automatically logged (≤500 entries).
- The trash can icon clears all records with one tap, with a confirmation dialog.
Settings
- Persistent attack: off by default—clearing the background automatically terminates the attack and restores the network; when enabled, exiting the app does not affect the attack process.
- Always expand device details.
Interface
- The About page features a full-screen AGSL colorful flowing light background, with transparent full-bleed status bar / navigation bar.
- Liquid glass floating bottom bar, with direct navigation across pages.
- miuix components and InstallerX Revived design language (dialogs / press feedback / empty-state typography).
- "Aurora Disconnect" app icon and transparent colorful logo.
Prerequisites
- Android 7.0 / API 24 or higher.
- Root access (KernelSU / Magisk / SuperSU, etc.).
- Connected to the target LAN Wi-Fi.
Installation
- Download the latest APK from Releases and install it.
- Grant Root permission on first launch.
- Connect to a LAN Wi-Fi; the app will automatically start scanning for devices.
- Toggle a device's switch to disconnect / restore its network.
Usage Instructions
- Network disconnection is based on ARP spoofing; please use it only on networks you own or are authorized to use.
- "Disconnect All" skips the local device and whitelisted devices by default.
- To continue disconnecting after clearing background apps, enable "Persistent Attack" in settings.
- If the network is abnormal, tap "Restore All", or restart the network device and phone.
- The list refreshes automatically every 5 seconds; no manual refresh is needed.
Use Cases
- Quickly restrict network access for a device on the local network.
- Disconnect local network devices in bulk and restore them at any time with one tap.
- Identify the vendor and type of local network devices and manage notes for them.
- Cybersecurity technical research, teaching demonstrations, and testing on your own network.
Build from Source
项目使用 Kotlin、Jetpack Compose、Android Gradle Plugin 和 Gradle Wrapper。
- JDK 17.
- compileSdk 37, minSdk 24, targetSdk 37.
Common commands:
./gradlew assembleRelease
构建产物位于 app/build/outputs/。CI：push 后 GitHub Actions 自动出包（release 使用固定签名密钥库，签名稳定）。
Implementation Highlights
- native/arpcut.c: Sends forged ARP replies via AF_PACKET raw sockets; the Ethernet source address uses the device's real MAC (Wi-Fi drivers drop frames whose source MAC is not the local one), while the ARP payload uses a fake MAC (
02:00:00:00:00:01) to mark the attack source.
- Broadcast-style GARP poisoning + 1s send interval improves cross-brand compatibility.
- Self-disconnection is achieved by repeatedly overwriting the local neighbor table (
ip neigh replace); forged frames do not enter the local protocol stack.
heal mode sends genuine ARP replies to restore mappings; before full recovery, the attack loop is terminated first, the neighbor table is restored, and re-resolution is triggered.
Getting Help
Disclaimer
- This tool is implemented based on ARP spoofing and is intended solely for testing and learning in networks you own or are authorized to use.
- Any unauthorized network disconnection or interference with others' networks or devices may violate relevant laws and regulations.
- All consequences and legal liabilities caused by the use of this tool are borne solely by the user; the developer assumes no responsibility.
- For details, see "About → Disclaimer" in the app.
Open Source License and Acknowledgments
License
See LICENSE.
fengguan/arpcut
