Comprehensive MITM attack toolkit for ARP poisoning, DNS spoofing, and network traffic interception and analysis in switched LAN environments.
ettercap -T -i {interface} -M arp:remote 🌍 interface → eth0 ettercap -T -i {interface} -M arp:remoteSandbox: execFile · Timeout: 86400s
security.mitm.arp security.mitm.dns security.poison.arp security.intercept.traffic security.spoof.dns security.sniff.password security.relay.ssl security.hijack.session | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
interface | string | No | - | Network interface to use | -i |
text-mode | boolean | No | - | Use text-only interface (no GUI) | -T |
gui-mode | boolean | No | - | Use graphical interface | -G |
mitm-method | string | No | - | MITM attack method (arp, dhcp, port, ndp) | -M |
write | file | No | - | Write captured packets to pcap file | -w |
read | file | No | - | Read packets from pcap file | -r |
silent | boolean | No | - | Silent mode (no ARP flooding) | -z |
filter | file | No | - | Load a filter script (etter.filter) | -F |
plugin | string | No | - | Run a specific plugin | -P |
verbose | boolean | No | - | Enable verbose output | -v |
ssl | boolean | No | - | Enable SSL stripping (mitm-attack) | -S |
quiet | boolean | No | - | Suppress packet display | -q |
N | boolean | No | - | Do not perform DNS spoofing. | -N, --no-dns |
O | boolean | No | - | file Output captured passwords to file. | -O |
j | boolean | No | - | file Log traffic in JSON format. | -j |
l | boolean | No | - | logfile Log all captured traffic. | -l |
u | boolean | No | - | Unoffensive mode (no packet forwarding). | -u |
x | boolean | No | - | Display hex dump of packets. | -x |
Inputs
network.interface Network interface for MITM operations
network.target.ip Target IP address for ARP poisoning
network.target.range Target IP range for network scan
Outputs
security.credential.password Captured credentials from intercepted traffic
network.capture.pcap Captured network traffic
security.hash Captured authentication hashes
network_trafficraw_socket_accessnetwork_traffic Produces
security.credential.passwordnetwork.capture.pcapsecurity.hashConsumes
network.interfacenetwork.target.ipnetwork.target.range| Resource | Value |
|---|---|
| CPU | low |
| Memory | 64 MB |
| Network | medium |
| Disk I/O | low |
ARP poisoning MITM attack in text mode
ettercap -T -i eth0 -M arp:remote /10.0.0.1/ /10.0.0.2/Passive network sniffing (no poisoning)
ettercap -T -i eth0 -sDNS spoofing with filter script
ettercap -T -i eth0 -M arp -F dns.spoofCapture traffic to pcap file
ettercap -T -i eth0 -M arp:remote -w capture.pcapLaunch GUI mode for interactive analysis
ettercap -GRead and analyze existing pcap
ettercap -T -r capture.pcapSSL stripping attack
ettercap -T -i eth0 -M arp:remote -SEttercap is a comprehensive suite for man-in-the-middle attacks on local area networks. It supports ARP poisoning, DNS spoofing, DHCP flooding, and passive sniffing with real-time traffic analysis, content filtering, and plugin-based extensibility.
| Method | Flag | Description |
|---|---|---|
| ARP poisoning | -M arp:remote |
Classic ARP cache poisoning |
| DHCP spoofing | -M dhcp |
Fake DHCP server |
| NDP poisoning | -M ndp |
IPv6 neighbor discovery spoofing |
| Port stealing | -M port |
Port stealing on switches |
Ettercap plugins extend functionality: dns_spoof (DNS response forgery), chk_poison (detect ARP poisoning), find_conn (find active connections), gw_discover (gateway discovery), remote_browser (inject HTML into HTTP streams).
Content filtering allows real-time packet manipulation: replace text in HTTP streams, inject scripts, drop packets, or modify protocol headers using etterfilter-compiled filter scripts.