Skip to content

WiFiKill on Ubuntu

TL;DR ✨

Every client on a Wi-Fi network believes the router is the default gateway. With ARP spoofing, you can lie about that relationship and convince other devices to send their traffic to your machine first.

If you then drop that traffic instead of forwarding it, they effectively lose network access.

⚠️ What This Actually Does

The point of this method is not magic. It abuses trust inside the local network.

Every client on a Wi-Fi network believes the router is the default gateway. With ARP spoofing, you can lie about that relationship and convince other devices to send their traffic to your machine first.

If you then drop that traffic instead of forwarding it, they effectively lose network access.

That is the whole trick.

🧠 Why This Works

ARP is the glue that connects IP addresses to MAC addresses on the local network.

If you tell the target device:

  • "the gateway is me"

and tell the gateway:

  • "the target is me"

you can position yourself in the middle or simply break communication.

That is why this technique has educational value. It shows how weak local trust can be when a network is poorly segmented and clients trust each other too easily.

πŸ› οΈ Basic Tooling

The original article used dsniff, specifically the arpspoof utility:

sudo apt-get install dsniff

Then it suggested reading the manual:

man arpspoof

That is the correct instinct. If you are using a tool that can intercept or break traffic, blindly copy-pasting commands is how you create chaos without understanding it.

1. Identify the Default Gateway

First, determine the local default gateway:

route -n

Or, in the rough shortcut style from the original article:

route -n|grep ^0.0.0.0|cut -d' ' -f 10

The important result is the router IP.

2. Scan the Local Network

Next, scan the surrounding devices so you know what is on the subnet.

The original workflow suggested either Angry IP Scanner or arp-scan, for example:

sudo apt-get install arp-scan
sudo arp-scan -l --interface=wlan0

That gives you a quick overview of:

  • IP addresses
  • MAC addresses
  • sometimes vendor hints

3. Poison the ARP Relationship

Once you know the target and the gateway, the spoofing step is straightforward.

Target one host:

arpspoof -t 192.168.0.108 192.168.0.1

Or poison the broader segment in the rough style shown in the article:

sudo arpspoof 192.168.0.1

From there, traffic gets redirected according to the forged ARP replies.

πŸ” Why This Matters Defensively

The offensive trick is simple, but the defensive lesson is more valuable:

  • local Wi-Fi is not automatically trustworthy
  • client isolation matters
  • encrypted application traffic is not the same as a secure local network
  • segmentation and controlled switching behavior reduce damage

Even a home or office network can become noisy fast if one device starts playing games with ARP.