ettercap
Multipurpose sniffer/interceptor/logger for switched LAN
Site oficial:
https://ettercap.github.io/ettercap/
Empacotamento:
https://salsa.debian.org/pkg-security-team/ettercap
Versão no Kali: 1:0.8.4.1-2 · Arquiteturas: any · Comandos: 7
Metapacotes:
kali-linux-default
kali-linux-everything
kali-linux-headless
kali-linux-large
kali-linux-nethunter
kali-tools-exploitation
kali-tools-sniffing-spoofing
kali-tools-social-engineering
Documentação do Kali:
https://www.kali.org/tools/ettercap/
Ettercap supports active and passive dissection of many protocols (even encrypted ones) and includes many feature for network and host analysis. Data injection in an established connection and filtering (substitute or drop a packet) on the fly is also possible, keeping the connection synchronized. Many sniffing modes are implemented, for a powerful and complete sniffing suite. It is possible to sniff in four modes: IP Based, MAC Based, ARP Based (full-duplex) and PublicARP Based (half-duplex). Ettercap also has the ability to detect a switched LAN, and to use OS fingerprints (active or passive) to find the geometry of the LAN. This package contains the Common support files, configuration files, plugins, and documentation. You must also install either ettercap-graphical or ettercap-text-only for the actual GUI-enabled or text-only ettercap executable, respectively.
sudo apt install ettercap-common (12.01 MB)
Dependências: ethtool, geoip-database, libc6, libcurl4t64, libmaxminddb0, libnet9, libpcap0.8t64, libpcre2-8-0, libssl3t64, zlib1g
Ettercap supports active and passive dissection of many protocols (even encrypted ones) and includes many feature for network and host analysis. Data injection in an established connection and filtering (substitute or drop a packet) on the fly is also possible, keeping the connection synchronized. Many sniffing modes are implemented, for a powerful and complete sniffing suite. It is possible to sniff in four modes: IP Based, MAC Based, ARP Based (full-duplex) and PublicARP Based (half-duplex). Ettercap also has the ability to detect a switched LAN, and to use OS fingerprints (active or passive) to find the geometry of the LAN. This package contains the ettercap GUI-enabled executable.
sudo apt install ettercap-graphical (594 KB)
Dependências: ettercap-common, libc6, libgdk-pixbuf-2.0-0, libglib2.0-0t64, libgtk-3-0t64, libncurses6, libpcre2-8-0, libtinfo6, pkexec, zlib1g
Escolha um comando ao lado para ver a descrição e a ajuda completa.
ettercap
Multipurpose sniffer/content filter for man in the middle attacks
root@kali:~# ettercap -h
ettercap 0.8.4.1 copyright 2001-2026 Ettercap Development Team
Usage: ettercap [OPTIONS] [TARGET1] [TARGET2]
TARGET is in the format MAC/IP/IPv6/PORTs (see the man for further detail)
Sniffing and Attack options:
-M, --mitm <METHOD:ARGS> perform a mitm attack
-o, --only-mitm don't sniff, only perform the mitm attack
-b, --broadcast sniff packets destined to broadcast
-B, --bridge <IFACE> use bridged sniff (needs 2 ifaces)
-p, --nopromisc do not put the iface in promisc mode
-S, --nosslmitm do not forge SSL certificates
-u, --unoffensive do not forward packets
-r, --read <file> read data from pcapfile <file>
-f, --pcapfilter <string> set the pcap filter <string>
-R, --reversed use reversed TARGET matching
-t, --proto <proto> sniff only this proto (default is all)
--certificate <file> certificate file to use for SSL MiTM
--private-key <file> private key file to use for SSL MiTM
User Interface Type:
-T, --text use text only GUI
-q, --quiet do not display packet contents
-s, --script <CMD> issue these commands to the GUI
-C, --curses use curses GUI
-D, --daemon daemonize ettercap (no GUI)
-G, --gtk use GTK+ GUI
Logging options:
-w, --write <file> write sniffed data to pcapfile <file>
-L, --log <logfile> log all the traffic to this <logfile>
-l, --log-info <logfile> log only passive infos to this <logfile>
-m, --log-msg <logfile> log all the messages to this <logfile>
-c, --compress use gzip compression on log files
Visualization options:
-d, --dns resolves ip addresses into hostnames
-V, --visual <format> set the visualization format
-e, --regex <regex> visualize only packets matching this regex
-E, --ext-headers print extended header for every pck
-Q, --superquiet do not display user and password
LUA options:
--lua-script <script1>,[<script2>,...] comma-separted list of LUA scripts
--lua-args n1=v1,[n2=v2,...] comma-separated arguments to LUA script(s)
General options:
-i, --iface <iface> use this network interface
-I, --liface show all the network interfaces
-Y, --secondary <ifaces> list of secondary network interfaces
-n, --netmask <netmask> force this <netmask> on iface
-A, --address <address> force this local <address> on iface
-P, --plugin <plugin> launch this <plugin> - multiple occurance allowed
--plugin-list <plugin1>,[<plugin2>,...] comma-separated list of plugins
-F, --filter <file> load the filter <file> (content filter)
-z, --silent do not perform the initial ARP scan
-6, --ip6scan send ICMPv6 probes to discover IPv6 nodes on the link
-j, --load-hosts <file> load the hosts list from <file>
-k, --save-hosts <file> save the hosts list to <file>
-W, --wifi-key <wkey> use this key to decrypt wifi packets (wep or wpa)
-a, --config <config> use the alternative config file <config>
Standard options:
-v, --version prints the version and exit
-h, --help this help screen
ettercap-pkexec
Graphical pkexec-based launcher for ettercap
root@kali:~# man ettercap-pkexec
ETTERCAP(8) System Manager's Manual ETTERCAP(8)
NAME
ettercap-pkexec - graphical pkexec-based launcher for ettercap
This launcher depends on policykit-1 and the menu packages, and basically
wraps the ettercap binary command
with a pkexec action script usually defined on /usr/share/polkit-1/ac-
tions/org.pkexec.ettercap.policy,
allowing users to directly call ettercap from the desktop or menu launcher
with root privileges.
The commands available are exactly the same as the ettercap man page.
Please refer to man ettercap for the list of available parameters.
(don't forget to change "ettercap" to "ettercap-pkexec" as caller pro-
gram).
example:
ettercap-pkexec -G will start ettercap with root privileges and the GTK2
interface.
AUTHOR
This code was originally taken from arch distro, and refactored to work
with cmake system by
Gianfranco Costamagna (LocutusOfBorg) <costamagnagianfranco@yahoo.it>
ORIGINAL AUTHORS
Alberto Ornaghi (ALoR) <alor@users.sf.net>
Marco Valleri (NaGA) <naga@antifork.org>
PROJECT STEWARDS
Emilio Escobar (exfil) <eescobar@gmail.com>
Eric Milam (Brav0Hax) <jbrav.hax@gmail.com>
OFFICIAL DEVELOPERS
Mike Ryan (justfalter) <falter@gmail.com>
Gianfranco Costamagna (LocutusOfBorg) <costamagnagianfranco@yahoo.it>
Antonio Collarino (sniper) <anto.collarino@gmail.com>
Ryan Linn <sussuro@happypacket.net>
Jacob Baines <baines.jacob@gmail.com>
CONTRIBUTORS
Dhiru Kholia (kholia) <dhiru@openwall.com>
Alexander Koeppe (koeppea) <format_c@online.de>
Martin Bos (PureHate) <purehate@backtrack.com>
Enrique Sanchez
Gisle Vanem <giva@bgnett.no>
Johannes Bauer <JohannesBauer@gmx.de>
Daten (Bryan Schneiders) <daten@dnetc.org>
SEE ALSO
etter.conf(5) ettercap_curses(8) ettercap_plugins(8) etterlog(8) etterfil-
ter(8)
AVAILABILITY
https://github.com/Ettercap/ettercap/downloads
GIT
git clone git://github.com/Ettercap/ettercap.git
or
git clone https://github.com/Ettercap/ettercap.git
BUGS
Our software never has bugs.
It just develops random features. ;)
KNOWN-BUGS
- ettercap doesn't handle fragmented packets... only the first segment
will be displayed by the sniffer. However all the fragments are correctly
forwarded.
+ please send bug-report, patches or suggestions to <ettercap-betatest-
ing@lists.sourceforge.net> or visit https://github.com/Ettercap/etter-
cap/issues.
+ to report a bug, follow the instructions in the README.BUGS file
PHILOLOGICAL HISTORY
"Even if blessed with a feeble intelligence, they are cruel and smart..."
this is the description of Ettercap, a monster of the RPG Advanced Dun-
geons & Dragon.
The name "ettercap" was chosen because it has an assonance with "ethercap"
which means "ethernet capture" (what ettercap actually does) and also be-
cause such monsters have a powerful poison... and you know, arp poison-
ing... ;)
The Lord Of The (Token)Ring
(the fellowship of the packet)
"One Ring to link them all, One Ring to ping them,
one Ring to bring them all and in the darkness sniff them."
Last words
"Programming today is a race between software engineers striving to build
bigger and better idiot-proof programs, and the Universe trying to produce
bigger and better idiots. So far, the Universe is winning." - Rich Cook
ettercap 0.8.4.1 ETTERCAP(8)
etterfilter
Filter compiler for ettercap content filtering engine
root@kali:~# etterfilter -h Usage: etterfilter [OPTIONS] filterfile General Options: -o, --output <file> output file (default is filter.ef) -t, --test <file> test the file (debug mode) -d, --debug print some debug info while compiling -w, --suppress-warnings ignore warnings during compilation Standard Options: -v, --version prints the version and exit -h, --help this help screen etterfilter 0.8.4.1 copyright 2001-2026 Ettercap Development Team
etterlog
Log analyzer for ettercap log files
root@kali:~# etterlog -h Usage: etterlog [OPTIONS] logfile General Options: -a, --analyze analyze a log file and return useful infos -c, --connections display the table of connections -f, --filter <TARGET> print packets only from this target -t, --proto <proto> display only this proto (default is all) -F, --filcon <CONN> print packets only from this connection -s, --only-source print packets only from the source -d, --only-dest print packets only from the destination -r, --reverse reverse the target/connection matching -n, --no-headers skip header information between packets -m, --show-mac show mac addresses in the headers -k, --color colorize the output -l, --only-local show only local hosts parsing info files -L, --only-remote show only remote hosts parsing info files Search Options: -e, --regex <regex> display only packets that match the regex -u, --user <user> search for info about the user <user> -p, --passwords print only accounts information -i, --show-client show client address in the password profiles -I, --client <ip> search for pass from a specific client Editing Options: -C, --concat concatenate more files into one single file -o, --outfile <file> the file used as output for concatenation -D, --decode used to extract files from connections Visualization Method: -B, --binary print packets as they are -X, --hex print packets in hex mode -A, --ascii print packets in ascii mode (default) -T, --text print packets in text mode -E, --ebcdic print packets in ebcdic mode -H, --html print packets in html mode -U, --utf8 <encoding> print packets in uft-8 using the <encoding> -Z, --zero do not print packets, only headers -x, --xml print host infos in xml format Standard Options: -v, --version prints the version and exit -h, --help this help screen etterlog 0.8.4.1 copyright 2001-2026 Ettercap Development Team
Ettercap supports active and passive dissection of many protocols (even encrypted ones) and includes many feature for network and host analysis. Data injection in an established connection and filtering (substitute or drop a packet) on the fly is also possible, keeping the connection synchronized. Many sniffing modes are implemented, for a powerful and complete sniffing suite. It is possible to sniff in four modes: IP Based, MAC Based, ARP Based (full-duplex) and PublicARP Based (half-duplex). Ettercap also has the ability to detect a switched LAN, and to use OS fingerprints (active or passive) to find the geometry of the LAN. This package contains the ettercap text-mode-only executable.
sudo apt install ettercap-text-only (308 KB)
Dependências: ettercap-common, libc6, libncurses6, libpcre2-8-0, libtinfo6, zlib1g
Escolha um comando ao lado para ver a descrição e a ajuda completa.
ettercap
Multipurpose sniffer/content filter for man in the middle attacks
root@kali:~# ettercap -h
ettercap 0.8.4.1 copyright 2001-2026 Ettercap Development Team
Usage: ettercap [OPTIONS] [TARGET1] [TARGET2]
TARGET is in the format MAC/IP/IPv6/PORTs (see the man for further detail)
Sniffing and Attack options:
-M, --mitm <METHOD:ARGS> perform a mitm attack
-o, --only-mitm don't sniff, only perform the mitm attack
-b, --broadcast sniff packets destined to broadcast
-B, --bridge <IFACE> use bridged sniff (needs 2 ifaces)
-p, --nopromisc do not put the iface in promisc mode
-S, --nosslmitm do not forge SSL certificates
-u, --unoffensive do not forward packets
-r, --read <file> read data from pcapfile <file>
-f, --pcapfilter <string> set the pcap filter <string>
-R, --reversed use reversed TARGET matching
-t, --proto <proto> sniff only this proto (default is all)
--certificate <file> certificate file to use for SSL MiTM
--private-key <file> private key file to use for SSL MiTM
User Interface Type:
-T, --text use text only GUI
-q, --quiet do not display packet contents
-s, --script <CMD> issue these commands to the GUI
-C, --curses use curses GUI
-D, --daemon daemonize ettercap (no GUI)
-G, --gtk use GTK+ GUI
Logging options:
-w, --write <file> write sniffed data to pcapfile <file>
-L, --log <logfile> log all the traffic to this <logfile>
-l, --log-info <logfile> log only passive infos to this <logfile>
-m, --log-msg <logfile> log all the messages to this <logfile>
-c, --compress use gzip compression on log files
Visualization options:
-d, --dns resolves ip addresses into hostnames
-V, --visual <format> set the visualization format
-e, --regex <regex> visualize only packets matching this regex
-E, --ext-headers print extended header for every pck
-Q, --superquiet do not display user and password
LUA options:
--lua-script <script1>,[<script2>,...] comma-separted list of LUA scripts
--lua-args n1=v1,[n2=v2,...] comma-separated arguments to LUA script(s)
General options:
-i, --iface <iface> use this network interface
-I, --liface show all the network interfaces
-Y, --secondary <ifaces> list of secondary network interfaces
-n, --netmask <netmask> force this <netmask> on iface
-A, --address <address> force this local <address> on iface
-P, --plugin <plugin> launch this <plugin> - multiple occurance allowed
--plugin-list <plugin1>,[<plugin2>,...] comma-separated list of plugins
-F, --filter <file> load the filter <file> (content filter)
-z, --silent do not perform the initial ARP scan
-6, --ip6scan send ICMPv6 probes to discover IPv6 nodes on the link
-j, --load-hosts <file> load the hosts list from <file>
-k, --save-hosts <file> save the hosts list to <file>
-W, --wifi-key <wkey> use this key to decrypt wifi packets (wep or wpa)
-a, --config <config> use the alternative config file <config>
Standard options:
-v, --version prints the version and exit
-h, --help this help screen
etterfilter
Filter compiler for ettercap content filtering engine
root@kali:~# etterfilter -h Usage: etterfilter [OPTIONS] filterfile General Options: -o, --output <file> output file (default is filter.ef) -t, --test <file> test the file (debug mode) -d, --debug print some debug info while compiling -w, --suppress-warnings ignore warnings during compilation Standard Options: -v, --version prints the version and exit -h, --help this help screen etterfilter 0.8.4.1 copyright 2001-2026 Ettercap Development Team
etterlog
Log analyzer for ettercap log files
root@kali:~# etterlog -h Usage: etterlog [OPTIONS] logfile General Options: -a, --analyze analyze a log file and return useful infos -c, --connections display the table of connections -f, --filter <TARGET> print packets only from this target -t, --proto <proto> display only this proto (default is all) -F, --filcon <CONN> print packets only from this connection -s, --only-source print packets only from the source -d, --only-dest print packets only from the destination -r, --reverse reverse the target/connection matching -n, --no-headers skip header information between packets -m, --show-mac show mac addresses in the headers -k, --color colorize the output -l, --only-local show only local hosts parsing info files -L, --only-remote show only remote hosts parsing info files Search Options: -e, --regex <regex> display only packets that match the regex -u, --user <user> search for info about the user <user> -p, --passwords print only accounts information -i, --show-client show client address in the password profiles -I, --client <ip> search for pass from a specific client Editing Options: -C, --concat concatenate more files into one single file -o, --outfile <file> the file used as output for concatenation -D, --decode used to extract files from connections Visualization Method: -B, --binary print packets as they are -X, --hex print packets in hex mode -A, --ascii print packets in ascii mode (default) -T, --text print packets in text mode -E, --ebcdic print packets in ebcdic mode -H, --html print packets in html mode -U, --utf8 <encoding> print packets in uft-8 using the <encoding> -Z, --zero do not print packets, only headers -x, --xml print host infos in xml format Standard Options: -v, --version prints the version and exit -h, --help this help screen etterlog 0.8.4.1 copyright 2001-2026 Ettercap Development Team
