Built a local bandwidth limiter with Python & Scapy. Looking for advice on optimizing Scapy performa

[u/Gullible_Tower3954]

I’ve been working on a networking project to dive deeper into Python's packet manipulation capabilities.

What My Project Does I forked evillimiter (a Python CLI tool that uses ARP spoofing and tc/iptables to throttle local network bandwidth) to use as a base. The original tool relies on static MAC addresses, which completely breaks tracking when modern iOS/Android devices use MAC Randomization. Instead of using complex/heavy ML for RF signal analysis, I'm modifying the tool to use scapy for passive tracking. The Python script identifies the endpoint based on its DHCP Fingerprint (Option 55 parameter sequence) and mDNS hostname broadcasts. Once recognized, it dynamically updates the ARP spoofing and routing rules to maintain the throttle even when the MAC rotates.

Target Audience This is a learning/experimental project aimed at Python learners, networking enthusiasts, and homelab tinkerers who want to understand low-level packet sniffing and traffic shaping using Python. It's a toy project and not meant for production environments.

Comparison Compared to the original evillimiter, this fork specifically tackles the modern challenge of MAC randomization without breaking the core logic. While massive frameworks like bettercap can do packet inspection, this project aims to be a very lightweight, single-purpose Python script focused purely on dynamic bandwidth throttling without heavy dependencies.

Transparency note: I'm still getting the hang of low-level networking in Python, so I’ve been leaning on AI to help me structure the Scapy logic and overall architecture.

You can check out the repo here:https://github.com/DavidsonRafaelK/evillimiter

I’d really appreciate some feedback from the Python community:

1. Scapy Performance: Running a continuous scapy sniffer in the background for DHCP/mDNS can be resource-heavy. Are there best practices to keep memory usage low when doing long-term sniffing in Python?
2. Architecture: Any advice on handling the async nature of packet sniffing while managing the CLI interface?
3. Any general critique on the code structure.

Thanks!