Evil Limiter is a command-line tool for Linux that lets a network administrator or pentester monitor, analyze, throttle, and block the bandwidth of individual devices on their local network without physical or administrative access to those devices.

What it is

Evil Limiter is a Python 3 command-line utility released under the MIT licence and published in the Security & Privacy / Threat Detection & Response category. It targets the local network an operator is themselves connected to, discovering hosts, tracking their traffic, and applying upload and download restrictions from an interactive shell. It lives in the Linux networking and security-tooling ecosystem, where it depends on ARP spoofing to intercept traffic and on tc traffic shaping to enforce the resulting rate limits.

The concrete problem it solves is congestion control over devices you can see but do not administer: a housemate's saturated video stream, a guest hogging the office uplink, or a suspect host during an engagement. Where the alternative is logging into a router with administrative credentials — or logging into each client machine — Evil Limiter instead positions itself between the target and the gateway, shaping packets as they pass. It resolves the network interface, netmask, and gateway address automatically, so the operator does not need to supply that configuration by hand, and it can flush the current iptables and tc configuration with the -f flag to ensure packets are dealt with correctly.

Key capabilities

• Scans the network for online hosts with scan, optionally restricted to a custom range such as scan --range 192.168.178.1-192.168.178.40, or across the entire subnet.
• Lists scanned hosts in a table with hosts, assigning each an ID used to address it in later commands; --force prints the table even when it does not fit the terminal.
• Throttles bandwidth with limit [ID1,ID2,...] [Rate], accepting bit, kbit, mbit, and gbit rates and either --upload or --download direction, for example limit 4,5,6 200kbit or limit all 1gbit.
• Cuts connectivity entirely with block [ID1,ID2,...], again direction-selective, and restores it with free [ID1,ID2,...], which removes all restrictions.
• Adds a host manually by IP with add [IP], resolving its MAC address automatically or accepting it explicitly with --mac.
• Reports live bandwidth usage of limited hosts through monitor, refreshing at a configurable --interval in milliseconds (default 500 ms).
• Takes network parameters explicitly via -i (interface), -g (gateway IP), -m (gateway MAC), and -n (netmask) when auto-resolution is not wanted, with --colorless to disable coloured output.

Who uses it and how

• A home or small-office administrator throttling a single device from an interactive session after running scan and reading IDs off the hosts table, for example limit all 1gbit.
• A penetration tester or red-team operator running it as part of the pentest toolchain implied by its pentesting and penetration-testing project topics, using block and free to control access during an engagement.
• An operator on a Linux laptop who must specify the active interface with -i and the gateway details with -g and -m when the host sits on an unusual network topology.
• Anyone tracking consumption over time who repeatedly invokes monitor --interval 1000 while limits are in force to watch current and total usage.
• A Windows user running the separate open-source EvilLimiter for Windows port instead, since this build requires a Linux distribution.

Getting started

Clone the repository with git clone https://github.com/bitbrute/evillimiter.git, install it with sudo python3 setup.py install, and launch it with evillimiter or python3 bin/evillimiter; alternatively download a version from the project's release page.

How it compares

Evil Limiter's Windows counterpart, EvilLimiter for Windows, is the named alternative for operators not on Linux, and this project is the Linux-native original behind it. Nothing else in this registry's facts covers the same ARP-spoofing-based local bandwidth-shaping role on Linux.

When to use it — and when not

It is the right choice when you are already on the target LAN with root-equivalent access on a Linux host — the tool manipulates iptables and tc and performs ARP spoofing, and it requires a Linux distribution with Python 3. It is not appropriate against hosts on other subnets, against IPv6-only networks, or on Windows without switching to the separate port, and it should not be used without authorisation on networks you do not manage. Bear in mind that ARP spoofing is detectable and disruptive if a limit is left applied, and that 28 open issues remain on the repository.

git clone https://github.com/bitbrute/evillimiter.git
cd evillimiter
sudo python3 setup.py install