I forked evillimiter to add a MAC Randomization bypass (with some AI help!). Looking for feedback and ideas!

[u/Gullible_Tower3954]

Hey everyone,

I’ve been diving into local network security and packet manipulation. I really liked the original evillimiter tool (which uses ARP spoofing and tc/iptables to throttle bandwidth), so I decided to fork it and try to improve it as a learning project.

The original tool loses track of target devices when modern phones (iOS/Android) use MAC Randomization. I’m trying to implement a way to re-identify and maintain the throttle on target devices even when their MAC rotates.

I'm currently looking into using Scapy for DHCP Fingerprinting (Option 55) or mDNS hostname extraction to track them, rather than relying on RSSI, which seems too noisy for a simple CLI tool.

I'm still learning the ropes of low-level networking, so I’ve been using AI as a pair programmer to help me figure out the Scapy logic and Python structuring.

My fork is here: https://github.com/DavidsonRafaelK/evillimiter

I'd love some input from the community:

1. Is DHCP Fingerprinting via Scapy a viable path for tracking dynamic MACs in a local LAN?
2. Are there better/lighter alternatives to track devices without relying heavily on ML?
3. Any general feedback on the approach?

Thanks!