ettercap

Start graphical interface

$ ettercap -G

$ ettercap -T -M arp:remote /[target1]// /[target2]//

$ ettercap -T -i [eth0]

$ ettercap -T

$ ettercap -T -P [dns_spoof]

$ ettercap -T -r [capture.pcap]

ettercap [options] [target1] [target2]

Ettercap is a comprehensive suite for man-in-the-middle attacks on LAN. It supports active and passive protocol analysis, including features for network and host analysis.
The tool can intercept traffic through ARP poisoning, allowing packet sniffing, injection, and filtering. Plugins extend functionality for DNS spoofing, OS fingerprinting, and more.
Ettercap is used for network security testing, protocol analysis, and penetration testing on authorized networks.

TARGET

Target specification (MAC/IP/PORT).

Graphical (GTK) interface.

Text-only interface.

MITM attack method.

Network interface.

Load plugin.

Read from pcap file.

Write to pcap file.

Display help information.

/etc/ettercap/etter.conf

Main configuration file controlling default interface, packet forwarding, plugin paths, and network settings.

DNS spoofing configuration mapping hostnames to IP addresses for the dns_spoof plugin.

Only use on authorized networks. May disrupt network operations. Detectable by security tools. Some attacks need root privileges.

Ettercap was created by Alberto Ornaghi and Marco Valleri, released as open source for network security research. It became a standard tool for man-in-the-middle attack demonstrations.

arpspoof(8), wireshark(1), mitmproxy(1)