Evil Limiter Next Generation
A tool to monitor, analyze and limit the bandwidth (upload/download) of devices on your local network without physical or administrative access.
evillimiter-ng employs ARP spoofing and traffic shaping to throttle the bandwidth of hosts on the network.
Requirements
- Linux distribution
- Python 3 or greater
Possibly missing python packages will be installed during the installation process.
Installation
# Using Pypi and Pip
pip install evillimiter-ng
# Without Pypi and Pip
git clone https://github.com/KevinCrrl/evillimiter-ng.git
cd evillimiter-ng
## Arch-based systems (or using the AUR: https://aur.archlinux.org/packages/evillimiter-ng)
cd pkgbuild
makepkg -si
## Other GNU/Linux distros using a virtual env
python -m build # Using python3-build
hatch build # Using hatch CLI
python -m installer dist/*.whl
# or without pypi, just with pip
pip install .
Quick Start Example
After installation, you can start using the tool with the following basic workflow.
- Start the program and specify your network interface:
evillimiter-ng -i wlan0
- Scan the network for connected hosts:
scan
- Limit bandwidth of a device (example: device ID 3 to 200kbit):
limit 3 200kbit
Example of a single-use command in the shell
# Scan the network, list hosts, block everyone for 20 seconds, and then restore connection.
echo "scan && hosts && block all && sleep 20 && free all && exit" | evillimiter-ng
Exporting/Importing a JSON file to save scans
# Scan the network, and save the results in a JSON file encoded in base64
scan && export-json my_network.json
With it, you can restore these results without a new scan in a future session:
import-json my_network.json
🛑 CRITICAL SECURITY WARNING
Base64 is NOT encryption (like PGP). It only obfuscates sensitive data (local IPs, MAC addresses) so they aren't visible to the naked eye. Any user or program can easily decode this file.
- Permissions: The file is read-proctected and write-protected (root only) to prevent corruption.
- Risk: Even if a malicious user obtains root access, they cannot decrypt what was never encrypted, but they can read, corrupt or destroy the information. Do not rely on this file for confidentiality.
Command-Line Arguments
| Argument | Explanation |
|---|---|
-h |
Displays help message listing all command-line arguments |
-i [Interface Name] |
Specifies network interface (resolved if not specified) |
-g [Gateway IP Address] |
Specifies gateway IP address (resolved if not specified) |
-m [Gateway MAC Address] |
Specifies gateway MAC address (resolved if not specified) |
-n [Netmask Address] |
Specifies netmask (resolved if not specified) |
evillimiter-ng Commands
| Command | Explanation |
|---|---|
scan (--range [IP Range]) (--intensity [(1,2,3)]) |
Scans your network for online hosts. One of the first things to do after start.--range lets you specify a custom IP range.--intensity lets you specify the scan intensity / speed (1 = quick, 2 = normal (standard), 3 = intense).Example: scan --range 192.168.178.1-192.168.178.40 --intensity 1 or just scan. |
hosts |
Displays all scanned hosts and basic information. |
limit [ID1,ID2,...] [Rate] (--upload) (--download) |
Limits bandwidth of host(s) associated with specified ID. |
block [ID1,ID2,...] (--upload) (--download) |
Blocks internet connection of host(s). |
free [ID1,ID2,...] |
Removes bandwidth restrictions. |
add [IP] (--mac [MAC]) |
Adds custom host manually. |
monitor [ID1,ID2,...] (--interval [time in ms]) |
Monitor bandwidth usage of host(s). |
analyze [ID1,ID2,...] (--duration [time in s]) |
Analyze traffic usage. |
watch |
Shows current watch status. |
watch add [ID1,ID2,...] |
Adds host(s) to watchlist. |
watch remove [ID1,ID2,...] |
Removes host(s) from watchlist. |
watch set [Attribute] [Value] |
Changes watch settings. |
clear |
Clears terminal window. |
quit |
Quits the application. |
sleep |
Waits for seconds. |
?, help |
Displays command help. |
import-json, export-json [JSON_FILE_PATH] |
Import/Export a JSON file containing IP addresses and MAC addresses encoded in base64. |
Restrictions
- Limits IPv4 connections only, since ARP spoofing requires ARP packets which exist only in IPv4 networks.
Legal Disclaimer
Please read the full legal disclaimer here:
License
Copyright (c) 2026 by KevinCrrl.
Licensed under the GPLv2 License.
For a detailed list of original authors, dependencies, and their respective licenses, see the CREDITS file.
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file evillimiter_ng-2.4.1.tar.gz.
File metadata
- Download URL: evillimiter_ng-2.4.1.tar.gz
- Upload date:
- Size: 152.9 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via:
twine/6.2.0 CPython/3.14.6
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
dd8057a7810123b2724e8f48dc7c917cb7cc05f34771c6a1bc5e116c5e8b8249
|
|
| MD5 |
44c9f8faabbdff2f5086e3e9ca34fcae
|
|
| BLAKE2b-256 |
808123d010ba2f3ff847126aa7a91809b2383d084e097a83ef216224543a82df
|
File details
Details for the file evillimiter_ng-2.4.1-py3-none-any.whl.
File metadata
- Download URL: evillimiter_ng-2.4.1-py3-none-any.whl
- Upload date:
- Size: 35.3 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via:
twine/6.2.0 CPython/3.14.6
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
166476f36b97d1bb54e276a63f32337cc3c2c56f6553133b99d79117d23a6954
|
|
| MD5 |
d73ecd34821f0ced7047f1dead553b19
|
|
| BLAKE2b-256 |
cd5f5b98ae0af8ef007cf38afd0620a8767b739fda51580d4411e9e8f431a04e
|
