I need to know how Tuxcut works. I am using it to cut the IP address of other computers in my subnet (Local Area Network) in college.

I have searched but haven't found anything.

I'm using TuxCut in X-Ubuntu and is not displaying any computers in my networks.. It only shows router's ip address....


The IP which you pass as argument to tuxcut, is sent a packet telling him that its gateway's MAC address is your MAC address. Hence, that IP sends all the packets to you and if you don't forward it to the actual gateway, they're silently dropped.

E.g. If there are two PCs in a subnet, whose IP addresses are IP_A and IP_B and their MAC addresses are MAC_A and MAC_B.

Suppose that the PC with IP IP_A tries to cut the net of PC with IP IP_B.

As you know, every PC before sending a packet asks for the MAC address of the gateway if it is not available on its cache. So when the PC with IP IP_B sends ARP Request for the MAC address of its gateway, it does that by MAC level broadcast: destination MAC is FF:FF:FF:FF:FF:FF.

IP_A PC replies to this with the ARP reply, which is unicast as sends its MAC (MAC_A) as the MAC address of gateway. So IP_B sends all packets to IP_A which doesn't forward the packet to actual gateway.

P.S.: You can check this by using Wireshark while using Tuxcut.

  • is this related with ARP poisining? – Arya Mar 23 '12 at 19:33
  • @Arya: It is an ARP Poisoning Attack. – pradeepchhetri Mar 24 '12 at 9:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.