NetAudit-L2

ARP-spoofing based network visibility tool for Kali Linux. NetAudit-L2 shows which devices on your network are visiting which sites by redirecting their traffic through your machine using classic ARP cache poisoning — no monitor mode, no WiFi password, no router access needed. Just a normal WiFi connection, like any other device.

📖 New to NetAudit-L2? See the full usage guide for step-by-step setup, both workflows, understanding the output, and a real troubleshooting section covering issues actually encountered during development.

NetAudit-L2 actively redirects another device's traffic through your machine. This is a real, active man-in-the-middle technique — a step beyond passive monitoring. Only run this against devices on a network you own or administer, and only with the knowledge of the people using those devices. Running this against a device or network you don't have the right to monitor may violate computer misuse or wiretapping laws depending on your jurisdiction.

NetAudit-L2 always restores correct ARP tables when stopped cleanly (via the Stop button or Ctrl+C) — always let it exit properly rather than killing the process abruptly, or affected devices may temporarily lose network connectivity until their own ARP cache naturally expires.

Unlike gateway-based tools, NetAudit-L2 doesn't need to run on your router. It works from any regular device on the network:

1. ARP poisoning: NetAudit-L2 sends forged ARP replies to a target device (claiming to be the gateway) and to the gateway (claiming to be the target). This causes the target's traffic to route through your machine instead of directly to the router.
2. IP forwarding: your machine relays the traffic onward to its real destination and back, so the target device's internet connection keeps working normally — they typically won't notice anything changed.
3. Passive capture: while traffic flows through, NetAudit-L2 extracts DNS queries and TLS ClientHello SNI (the plaintext hostname sent at the start of every HTTPS connection) to identify which sites were visited.
4. Clean restore: on stop, NetAudit-L2 sends corrective ARP replies to both the target and the gateway, and disables IP forwarding, returning the network to normal.

netauditl2/
├── netauditl2/
│   ├── arp_spoof.py       # Core ARP poisoning + traffic capture logic
│   ├── arp_manager.py     # Background thread manager for the web UI
│   ├── device_resolver.py # MAC -> friendly device name
│   ├── domain_labels.py   # CDN domain -> brand name labels (you build this)
│   ├── db.py               # SQLite storage layer
│   └── cli.py               # Command-line summary views
├── web/
│   ├── app.py                # Flask dashboard + Control Center
│   └── templates/            # Dashboard/Control Center HTML
├── config.yaml               # Your device names and domain labels
└── requirements.txt

git clone <your-repo-url>
cd netauditl2
pip install -r requirements.txt --break-system-packages
sudo apt install aircrack-ng   # only needed if you don't already have it (for reference tools; NetAudit-L2 itself doesn't call airodump-ng)

Edit config.yaml to name your own devices:

devices:
  aa:bb:cc:dd:ee:01: "Mom's iPhone"

sudo python3 web/app.py

Then open http://localhost:8788/control:

1. Enter your network interface (e.g. wlan0 — your normal WiFi interface, not monitor mode) and your subnet (e.g. 192.168.1.0/24).
2. Click Discover Devices — this ARP-scans the subnet and lists live hosts.
3. Check the box next to the device(s) you want to monitor (the gateway is automatically excluded).
4. Click Start Monitoring Selected — you'll be asked to confirm before anything starts.
5. Watch Devices Seen and Live Activity update as traffic is captured.

# Discover live hosts first
sudo python3 -m netauditl2.arp_spoof -i wlan0 --discover 192.168.1.0/24

# Then target specific device(s)
sudo python3 -m netauditl2.arp_spoof -i wlan0 --targets 192.168.1.50 192.168.1.51

Type YES when prompted to confirm. Press Ctrl+C to stop and restore the network cleanly.

python3 -m netauditl2.cli sites      # clean view: device, IP, website (deduplicated)
python3 -m netauditl2.cli devices    # all devices seen
python3 -m netauditl2.cli recent     # raw recent query log
python3 -m netauditl2.cli history <mac>

TLS SNI often reveals a CDN backend hostname (e.g. googlevideo.com) rather than the brand name a user would recognize (e.g. "YouTube"). NetAudit-L2 ships with no pre-loaded labels — build your own list as you encounter domains worth labeling:

python3 -m netauditl2.cli label googlevideo.com "YouTube"

This is saved to config.yaml under site_labels and applied automatically in both the CLI and dashboard from then on.

• QUIC (HTTP/3) traffic isn't parsed. A large amount of modern browsing (especially Google/YouTube) uses QUIC over UDP port 443, which encrypts its handshake differently than classic TLS. NetAudit-L2 currently only extracts SNI from standard TCP-based TLS ClientHellos.
• Requires a captured connection's opening handshake. If a device's connection was already established before you start monitoring, you'll only see its later packets (or teardown), not the original ClientHello with the SNI. Best results come from monitoring continuously so new connections are caught as they happen.
• Some routers/gateways actively detect and block ARP spoofing (common on modern ISP-provided gateways with built-in security suites). If poisoning doesn't seem to take effect — check arp -a on the target device; if the gateway's MAC still shows correctly (not your machine's MAC), the network likely has ARP-spoofing protection active.

Built to apply penetration testing and network security coursework (ARP/IP fundamentals, TLS internals) to a genuinely working tool — including debugging a real bug found through systematic packet-level log analysis (an SNI-extraction check was incorrectly gated behind a Raw layer condition that doesn't exist once Scapy successfully parses TLS, silently dropping valid ClientHellos).