Evil Limiter

This project is a maintained fork of bitbrute/evillimiter. The upstream repository is no longer maintained, so this fork continues development - bug fixes, new features, and compatibility updates. See Fork-specific changes below.

A tool to monitor, analyze and limit the bandwidth (upload/download) of devices on your local network without physical or administrative access.
evillimiter employs ARP spoofing and traffic shaping to throttle the bandwidth of hosts on the network. On IPv6-enabled networks, NDP spoofing is used alongside ARP spoofing to also cut off a host's IPv6 traffic, which would otherwise bypass the IPv4-only limit/block.

Searching for a Windows-compatible version?
Check out the open-source alternative EvilLimiter for Windows.

Requirements

• Linux distribution
• Python 3 or greater

Possibly missing python packages will be installed during the installation process.

Compatibility notes

evillimiter locates tc, iptables and sysctl via PATH at startup and errors clearly if one is missing. It shells out to the iptables binary specifically - on distros where iptables is an iptables-nft compatibility shim this generally works, but a firewall managed purely through native nft rules with no iptables shim installed is not something this tool talks to.

Installation

git clone https://github.com/DavidsonRafaelK/evillimiter.git
cd evillimiter
python3 -m venv .venv
source .venv/bin/activate
pip install .

Run it with sudo (raw sockets, iptables/tc need root) - it's the run that needs root, not the install:

sudo .venv/bin/evillimiter

Note: sudo python3 setup.py install (the old instructions) is deprecated in modern setuptools and often fails outright with ModuleNotFoundError: No module named 'setuptools' - sudo runs the system Python, which usually doesn't have setuptools installed, unlike the venv's own Python that pip manages for you. On distros that enforce PEP 668 (Arch, Debian 12+, ...), installing outside a venv is blocked entirely for this reason.

Alternatively, you can download a desired version from the Release page.

Usage

Type evillimiter or python3 bin/evillimiter to run the tool.

evillimiter will try to resolve required information (network interface, netmask, gateway address, ...) on its own, automatically.

Command-Line Arguments

Config file

Any of the flags above (except -f/--flush, which is a one-shot action, not a persisted preference) can be given a default in an optional ini file at ~/.config/evillimiter/config.ini (or $XDG_CONFIG_HOME/evillimiter/config.ini). A command-line flag always overrides the config file.

[general]
interface = wlan0
colorless = true
log_file = /var/log/evillimiter.log

[watch]
interval = 30
range = 192.168.1.1-192.168.1.50

[watch] sets the initial values normally set at runtime via watch set interval/watch set range (see below), so they don't need to be re-entered every session.

evillimiter Commands

Restrictions

• Rate-limits IPv4 traffic only, since ARP spoofing requires the ARP packet that is only present on IPv4 networks. On networks with an IPv6 default route, a host's IPv6 traffic is instead fully blocked via NDP spoofing rather than rate-limited, since the tc/iptables rules that shape traffic are IPv4-only.
• Cellular fallback defeats it. A blocked/limited phone can just switch to LTE/5G once WiFi degrades (Android "avoid poor connections", iOS equivalents) - that traffic never touches your network at all.
• MAC-randomizing devices reappear as a new host on reconnect. Many phones present a different MAC per network join by default, so watch (matches by MAC) can't follow them; the old restriction is left bound to a MAC/IP nobody uses anymore.
• Already-open connections can straggle. A stream/download in progress doesn't always re-resolve the gateway's address mid-flight, so it can keep flowing on a stale ARP/NDP cache entry until it naturally resets - new connections are caught immediately.
• Devices on a different subnet/VLAN are invisible. Band-steering mesh systems that split 2.4GHz/5GHz onto separate subnets can let a host roam outside the scanned IP range entirely.
• A second network path bypasses it. A device that also has Ethernet (mainly laptops, not phones) can switch to it and land on an untouched segment.
• Managed switches with Dynamic ARP Inspection can block the spoofing outright. Irrelevant on typical home routers, matters on corporate/enterprise networks.

Fork-specific changes

Everything below was added in this fork, on top of upstream's last release (v1.5.0):

• IPv6 (NDP) spoofing, so limit/block also cover a host's IPv6 traffic instead of only IPv4
• Optional config file (~/.config/evillimiter/config.ini) for default flags and watch settings
• -l/--log-file to persist ok/error messages to a file
• --version flag
• mDNS/NetBIOS/DHCP hostname fallback when reverse DNS fails
• block now also blocks the INPUT/OUTPUT chains (traffic to/from this machine itself), not just FORWARD
• watch now shows each watched host's Online/Offline status and auto-watches hosts on limit/block
• Host tracking keyed off MAC address instead of IP (fixes reconnect detection and a hash/equality bug)
• limit/block report tc/iptables failures instead of silently claiming success
• Fixed a false-positive/duplicate-command bug in restriction teardown for combined upload+download limits/blocks
• Fixed ByteValue formatting for totals in the terabyte range
• CI running the test suite on every push/PR

See CHANGELOG for the full version history, including upstream's.

Contributing

Want to report a bug, request a feature, or submit a pull request? See CONTRIBUTING.md for the rules on filing issues and opening PRs. Please also read the Code of Conduct.

Disclaimer

Evil Limiter - originally created by bitbrute, now maintained by DavidsonRafaelK - is provided "as is" and "with all faults". Neither the original author nor the current maintainer makes any representations or warranties of any kind concerning the safety, suitability, lack of viruses, inaccuracies, typographical errors, or other harmful components of this software. There are inherent dangers in the use of any software, and you are solely responsible for determining whether Evil Limiter is compatible with your equipment and other software installed on your equipment. You are also solely responsible for the protection of your equipment and backup of your data, and neither party will be liable for any damages you may suffer in connection with using, modifying, or distributing this software.

License

Copyright (c) 2019-2026 by bitbrute, copyright (c) 2026 by DavidsonRafaelK for fork-specific changes. Some rights reserved.
Evil Limiter is licensed under the MIT License as stated in the LICENSE file.