How NetCut Works & How to Protect from Spoofing
NetCut is a Denial of Service type of tool that runs on Windows and is capable of cutting off a person’s internet connectivity when both are connected in the same local area network. Basically the ARP protocol is used to translate IP addresses to MAC addresses and NetCut exploits the weakness in the stateless ARP protocol due to the lack of authentication.
NetCut is very easy to use and can be used by anyone. Simply run the tool and it will detect all the connected devices in the same local area network. You can then select any target from the list followed by clicking the “Cut off” button, and within seconds the target will lose its internet connection. The affected target will have no idea what’s happened even if he/she has a firewall program installed.
Due to the way NetCut works, no firewall is able to prevent nor even detect the attack. In fact setting up static ARP entries like most other websites suggested will not protect you against NetCut attacks because NetCut directly attacks the gateway and not the user. Here is an investigation on how NetCut works and also the method to protect against the DoS attack.
As we’ve mentioned earlier, none of the firewall software such as ZoneAlarm, Comodo, Outpost, GlassWire, SpyShelter, Privatefirewall, and etc is able to detect NetCut attack. However you can use XArp, which is a freeware tool that can detect ARP spoofing. By installing XArp and running it, you will be instantly notified when it detects an ARP spoofing attack including the attack from NetCut. The screenshot below shows a running XArp without attacks. Take note of the MAC address 00-21-5d-41-16-5a circled in red which is associated with the IP 192.168.2.8.
When NetCut starts attacking the IP 192.168.2.8 in an attempt to cut off the Internet connection, XArp immediately detects it and shows an alert popup with a few different messages. The most important message would be the one that reports that the MAC address for the IP 192.168.2.8 has been changed from 00-21-5d-41-16-5a to 03-27-75-49-18-73.
If you launch the XArp program from the notification tray icon, you will see that the MAC address for the IP 192.168.2.8 has been changed to 03-27-75-49-18-73 which is obviously wrong.
This means that NetCut sends a spoofed packet to inform the gateway that the IP 192.168.2.8 is associated with an incorrect MAC address. Since the IP 192.168.2.8 isn’t mapped to the correct MAC address, the Internet connection breaks as well. Even a packet sniffer such as Wireshark confirms that spoofed packets are sent to the gateway with a wrong MAC address mapped to the IP 192.168.2.8.
When NetCut is actively attacking a target on the network, it will continuously send spoofed packets to the gateway so that there is no chance for the gateway to obtain the correct dynamic ARP table. Here we have 5 possible ways of protecting against NetCut attacks.
1. Static ARP Table in Router
Since NetCut sends spoofed packets to the router to mess with the dynamic ARP table, you can solve this problem by setting up a static ARP table in the router. Implementing static ARP routing will protect everyone that is connected to the network. However this is not really a solution for everyone because a lot of basic home based routers don’t support static ARP table and it doesn’t make sense to implement this on a public WiFi. Doing this on a large corporate network also requires a lot of manpower maintaining the IP to MAC address mappings.
2. NetCut
Ironically, the NetCut program that is used to cut off a person’s Internet connection has an option to protect against the attack. Simply make sure that the “Protect My Computer” checkbox is ticked and this will ensure that your IP address is mapped to the correct MAC address.
Basically NetCut protects against its own attack by constantly sending packets to the gateway informing the router the correct mapping of the IP to MAC address. The router will be easily flooded with packets when NetCut is being used to attack and protect.
3. NetCut Defender
If you’re not comfortable in having an attack program such as NetCut installed and running on your computer due to legal concerns, the author of NetCut also created a protection program called NetCut Defender. Basically it does the same thing as the “Protect My Computer” option found in NetCut except without the ability to cut off a person’s connection.
Nowhere on the official NetCut Defender’s website does it mention that it costs $9.99. You will start getting nagging popups to purchase the program after a couple of hours of usage. We cannot confirm the trial usage of NetCut Defender as we have not tested it extensively but what we can confirm is that it can surely keep you safe against NetCut attacks.
4. Outpost Firewall Pro
When NetCut is launched, it will automatically run an ARP broadcast sweep to detect all connected devices on the network. For example, if the computer running NetCut is connected to a network 192.168.2.1 gateway, it will perform an ARP sweep from 192.168.2.1 to 192.168.2.255. Unlike ICMP ping that can be easily blocked, ARP requests are normally responded and not blocked. When a device responds to the ARP request made by NetCut, the device is added to the list that can be attacked. Outpost Firewall Pro has an option to block ARP scan.
Go to Settings > Advanced settings > Attack Detection > click the Customize button > select “Block host when it enumerates other computers on LAN” and click OK to close the Attack Detection window followed by clicking OK to save the Settings.
Enabling this option will prevent your computer from being listed in NetCut. The attacker will most likely attack another computer instead of yours. Outpost Firewall Pro is a shareware that cost $29.95 for a 1 year subscription on a single license.
5. ESET Smart Security
ESET Smart Security is one of the few internet security applications that can be configured to disallow responses to an ARP request. By doing this, NetCut won’t be able to find your computer during an ARP sweep when the program is launched or when the “Refresh Net” button is clicked. To configure ESET Smart Security to block an ARP scan, open the program, go to Setup and click on Network. Click Advanced Personal firewall setup that is located at the bottom.
Expand Network > Personal firewall and select IDS and advanced options. Uncheck “Allow response to ARP requests from outside the Trusted zone” and click OK.
For this setting to take effect, you need to select the “Public network” as the desired protection mode of your computer in the network. Normally this option would show up when you are connected to a new network. To check the settings, at the Network protection setup, click on “Change the protection mode of your computer in the network“.
Select Public network option and click OK.
The NetCut program won’t be able to find your computer on the network, thus keeping you safe from being attacked.
I need some help my brother installed netcut on the computer and sometime uses it to cut off the wifi connection on my phone
So any idea how I can protect my phone from netcut.
android mobile also have “netcut” & also it have “defender” function, which mentioned above
Thank you. Very helpful.
Aha, this is useful. I noted that I already did a lot of the protection as I have an annoying router, BUT it happens to support some more advanced protection. Or so I THINK, ahahaha (until I get into more advanced pen testing to VERIFY somewhat).
Good luck.
Look into open source routers and the arptables package that should be possible to run on them, that kind of thing… Again, I’m not expert.
thnx a lot.
thx for it
Thanks for the article.
I tried Netcut android version , i atacked my own pc but the atack could not affect the computer connection to the internet since i had the anti arp-spoofing enabled on Comodo Firewall.
Your android phone must be rooted to cut anyone ( even your pc )
thanks
Thanks alot that was helpful
Big Thanks
Discovered someone on my home wireless network is now using this tool. I need access to broadband for work, but cannot take any risks that the company computer is attacked, that data sent/received is compromised or that I lose connectivity. Should I start again and create a new network?
I Love this tutorial. Thanks a million!!
You Are Awesome :)
I’ve used to use AntiArp on windows xp 32bit, but after upgrading my computer (Costed me 5000 EGP), I was unable to use AntiArp program anymore :(
but here you told me a marvelous methods to protect myself
thanks a lot.
really thank you for explaining briefly about net cut