ETTERCAP(8)

NAME
ettercap 0.6.3.1 - A multipurpose sniffer over switched LANs

SYNOPSIS
ettercap [OPTIONS] [HOST:PORT] [HOST:PORT] [MAC] [MAC]

DESCRIPTION
Ettercap was born as a sniffer for switched LAN (and obviously even "hubbed" one), but during the development process it has gained more and more feature that have changed it to a powerful and flexible tool for man-in-the-middle attacks. It supports active and passive dissection of many protocols (even ciphered ones) and includes many feature for network and host analysis (such as OS fingerprint).

It has five sniffing methods:
+ IPBASED, the packets are filtered matching IP:PORT source and IP:PORT dest
+ MACBASED, packets filtered matching the source and dest MAC address. (useful to sniff connections through gateway)
+ ARPBASED, uses arp poisoning to sniff in switched LAN between two hosts (full-duplex m-i-t-m).
+ SMARTARP, uses arp poisoning to sniff in switched LAN from a victim host to all other hosts knowing the entire list of the hosts (full-duplex m-i-t-m).
+ PUBLICARP, uses arp poison to sniff in switched LAN from a victim host to all other hosts (half-duplex).
With this method the ARP replies are sent in broadcast, but if ettercap has the complete host list (on start up it has scanned the LAN) SMARTARP method is automatically selected, and the arp replies are sent to all the hosts but the victim, avoiding conflicting MAC addresses as reported by win2K.

The most relevant ettercap features are:

Characters injection in an established connection : you can inject character to server (emulating commands) or to client (emulating replies) maintaining the connection alive !!

SSH1 support : you can sniff User and Pass, and even the data of an SSH1 connection. ettercap is the first software capable to sniff an SSH connection in FULL-DUPLEX

HTTPS support : you can sniff http SSL secured data... and even if the connection is made through a PROXY

Plug-ins support : You can create your own plugin using the ettercap's API.

Password collector for : TELNET, FTP, POP, RLOGIN, SSH1, ICQ, SMB, MySQL, HTTP, NNTP, X11, NAPSTER, IRC, RIP, BGP, SOCKS 5, IMAP 4, VNC, LDAP, NFS, SNMP, HALF LIFE (other protocols coming soon...)

Packet filtering/dropping: You can set up a filter chain that search for a particular string (even hex) in the TCP or UDP payload and replace it with yours or drop the entire packet.

Passive OS fingerprint: you scan passively the lan (without sending any packet) and gather detailed info about the hosts in the LAN: Operating System, running rervices, open ports, IP, mac address and network adapter vendor.

OS fingerprint: you can fingerprint the OS of the victim host and even its network adapter (it uses the nmap (c) Fyodor database)

Kill a connection: from the connections list you can kill all the connections you want

Packet factory: You can create and sent packet forged on the fly. The factory let you to forge from Ethernet header to application level.

OPTIONS
Options that make sense together can generally be combined. ettercap will warn the user about unsupported option combinations.

SNIFFING METHODS

-a, --arpsniff
    ARP BASED sniffing
    This is THE sniffing method for switched LAN, and if you want to use the man-in-the-middle technique you have to use it. In conjunction with the silent mode (-z option) you must specify two IP and two MAC for ARPBASED (full-duplex) or one IP and one MAC for PUBLICARP (half-duplex). in PUBLICARP the ARP replies are sent in broadcast, but if ettercap has the complete host list (on start up it has scanned the LAN) SMARTARP method is automatically selected, and the arp replies are sent to all the hosts but the victim, and an hash table is created to re-route back the packet form victim to client obtaining in this way a full-duplex man in the middle attack.
    NOTE: if you manage to poison a client with the smart arp sniffing, remember to set the gateway's IP in the conf file (GWIP option) and load it with the -e option, otherwise that client will not be able to connect to remote hosts.
    Filters that have as action a replacement or a drop, can be used only with ARPBASED sniffing because it is necessary to re-adjust the sequence number in full-duplex in order to maintain the connection alive.

-s, --sniff
    IP BASED sniffing
    This is the good old style sniffing method. It rocks on "hubbed" LAN, but useless on switched ones. You can choose the target specifying only source, only dest, with or without port, or nothing (to sniff all connections). A special ip "ANY" means from or to every host.

-m, --macsniff
    MAC BASED sniffing
    Very useful to sniff TCP traffic with remote hosts. On hubbed LANs if you want to sniff a connection through a gateway is useless to specify the victim's ip and the gateway's ip, because the packet are for an external host, not for the gateway. So you can use this method. Simply specify the victim's MAC and the gateway's MAC and you will see all the connections from and to the Internet.

GENERAL OPTIONS

-N, --simple
    NON interactive mode (without ncurses)
    This method is useful if you want to launch ettercap from a script or if you already know some informations of your target or if you want to launch ettercap in background collecting data or password for you (in combination with the --quiet option).
    Some features are not available in this method, obviously the ones which requires interaction with the user, such as characters injection. But others (for example filtering) are fully supported, so you can set up ettercap to poison two host (a victim and its gateway) and to filter all its connection on the port 80 and replace some string with others, all its traffic to the Internet will be changed as you wish.

-z, --silent
    start in silent mode (no arp storm on start up)
    If you want to launch ettercap with a non invasive method (some NIDS may raise a warn if they detects too much arp request). You have to know all the requested data of the target in order to use this options. For example if you want to poison two host, you need the two IP and the two MAC addresses of the victims. If you select ipsniff or macsniff this method is automatically selected, because you don't need to know the list of the host in the LAN.
    To know the entire list of the hosts use "ettercap -Nl", but remember that it is a invasive method.

-O, --passive
    Collect infos in passive mode. This method WILL NOT SEND ANY packet on the wire. It will put the interface in promiscuous mode and look for packets passing through it. every interesting packet (SYN or SYN+ACK) is analyzed and used to make a complete map of the LAN.
    The infos collected are: IP and MAC of the hosts, type of Operating System (passive OS fingerprint), network adapter vendor and running services. (for a technical description refer to README) In the list are show even other infos: "GW" if the host is a GateWay, "NL" if the IP is not belonging to the LAN and "RT" if the host act as a router.
    Useful if you want to make a start up host list in complete passive mode, when you are satisfied of the collected infos, you can convert it to the startup host list by simply press 'C', and then work as usual.
    The description of its functionality in simple mode is explained in the next section.

-b, --broadping
    use a broadcast ping instead of arp storm on start up.
    this method is less intrusive, but even less accurate. some hosts will not respond at the broadcast ping (es. Windows) so they remain invisible to this method. Useful if you want to scan a LAN with Linux hosts. As usual you can combine this option with --list to have a list of the hosts "ettercap -Nlb"

-D, --delay <n sec>
    the delay in seconds between the arp replies if you have selected an ARP poison sniffing method. This is useful if you want to be less aggressive in the poisoning. On many OS the default validity interval of the arp cache is more than a minute (on FreeBSD is 1200 sec).
    The default delay value is 30 sec.

-Z, --stormdelay <n usec>
    the delay in micro-seconds between the arp request on arp storm at start up. This is useful if you want to be less aggressive in the scanning. Many IDS will report massive arp request, but if you send them in a slower rate, they will not report any strange behavior.
    The default delay value is 1500 usec.

-S, --spoof <IP>
    If you want to elude some IDS, you can specify a spoofed IP used to scan the LAN with arp request. The source MAC can't be spoofed because a well configured switch will block your request.

-H, --hosts <IP1[,IP2][,IP3][,...]>
    on start up, scan only these hosts.
    this is useful if you want to use an ARP scanning of the LAN but only on certain IPs. so you can benefit from a ARP scan but remaining less invasive. Useful even if you want to do PUBLIC ARP but you want to poison only specific hosts. since with a list PUBLIC ARP is automatically converted to SMARTARP, only these host will be poisoned and you can leave untouched the arp caches of the other hosts.
    the IP list must be in dotted notation and separated by comma (without black spaces between them), you can use wildcards.
    eg: 192.168.0.2? --> from 20 to 29
        192.168.0.1* --> host 1, from 10 to 19 and from 100 to 199

-d, --dontresolve
    don't resolve IPs on start up. this is useful if you experience an insane "Resolving n hostnames..." message on start up. This is due to a very slow DNS in your environment.

-i, --iface <IFACE>
    network interface to be used for all the operation. you can even specify network aliases in order to scan a subnet with different ip form your current one.

-n, --netmask <NETMASK>
    the netmask used to scan the LAN. (in dotted notation). the default is your current ifconfig netmask. but your netmask is for example 255.255.0.0 I encourage you to specify a more restrictive one, if you managed to do an ARP scanning on start up.

-e, --etterconf <FILENAME>
    use the config file instead of command line options
    etter.conf example file is packaged in the tarball, refer to it to know how to write a config file. all the instruction are written in this example. via the conf file you can disable selectively one protocol dissector or move it on one other port.
    command line options and config file can be mixed for much flexibility, but remember that the options in the config file override the command line, so if in etter.conf you have specified IFACE: eth0, and you launch "ettercap -i eth1 -e etter.conf" the selected iface will be eth0.
    NOTE: the "-e etter.conf" options has to be specified after all other options.

-t, --linktype
    this flag ha two complementary function. so mind it !
    if used in interactive mode it DOESN'T check for lan type. On the other hand, if used in conjunction with command line mode (-N) it DOES a check to discover if you are on a switched LAN or not... Sometimes if there are only 2 hosts in the lan this discovery method can fail.

-j, --loadhosts <FILENAME>
    it is used to load an hosts list from a file created by the -k option. (see below)

-k, --savehosts
    saves the hosts list to a file. useful when you have many hosts and you don't want to do an arp storm at startup any time you use ettercap. simply use this options and dump the list to a file, then to load the information from it use the -j <filename> option.
    the file is in the form "netaddress_netmask.ehl"

-v, --version
    check for the latest ettercap version.
    All operation are under your control. Every step requires a user confirmation. With this option ettercap will connect to the http://ettercap.sourceforge.net:80 web side and ask for the page /latest.php. then the result are parsed and compared with your current version. If there is a newer version available, ettercap will ask you if you want to wget it. (wget must be in the path).
    If you want to automatically answer yes at all the question add the option -y

-h, --help
    prints the help screen with a short summary of the available options.

SILENT MODE OPTIONS (only combined with -N)

-u, --udp
    sniff only UDP packets (default is TCP). This option is only useful in "simple" mode, if you start ettercap in interactive mode both TCP and UDP are sniffed.

-R, --reverse
    sniff all the connection but the selected one. This option is useful if you are using ettercap on a remote machine and you want to sniff all the traffic but you connection from local to remote, because including it will sniff even the ettercap output and it will be screwed up...

-O, --passive
    Collect infos in passive mode as described in the previous section. In simple mode we can use this option in many mode.
    "ettercap -NO" will start ettercap in semi-interactive mode, hit 'h' for help. You can view or log to a file a detailed report of the collected infos, or simply view each alert of analyzed packet.
    "ettercap -NOL" as above but it log automatically the data into a file every 5 min.
    "ettercap -NOLq" deminizes ettercap and log to a file every 5 minutes. Go away and smoke your cigarette... return and a complete report of the lan is there waiting for you... ;)

-p, --plugin <NAME>
    run the external plugin "NAME".
    most plugins need a destination host. simply specify it after plugin name, in fact hosts are parsed on command line as first the DEST and so the SOURCE.
    To have a list of the available external plugins use "list" (without quotes) as plugin name.

    Since ettercap 0.6.2 hooking plugins system is provided, so some plugins are not executed as a separated program, they can interact with ettercap and can be enabled or disabled via the interface or conf file.

    More detailed info about plugins and about how to write your own are found in the README.PLUGINS file.

-l, --list
    lists all the hosts in the LAN, reporting each MAC address.
    Commonly combined options are -b (for broadcast ping) and -d (don't resolve hostname).

-C, --collect
    collect all users and password from the hosts specified on command line.
    Password collector are configured in the config file (etter.conf), if you want you can disable them selectively or move them on other port. This is useful if you don't want to sniff SSH connection (the key change alert will raise suspects) but want to sniff all other supported protocols. Or even if you know that a host has the telnet service on port 4567, simply move the telnet dissector on 4567/tcp

-f, --fingerprint <HOST>
    do OS fingerprinting on HOST.
    This option uses the same database and the same method used by nmap (c) Fyodor <fyodor@insecure.org> so I report a piece of its man page :

    This option activates remote host identification via TCP/IP fingerprinting. In other words, it uses a bunch of techniques to detect subtleties in the underlying operating system network stack of the computers you are scanning. It uses this information to create a 'fingerprint' which it compares with its database of known OS fingerprints (the nmap-os-fingerprints file) to decide what type of system you are scanning.

    the -f options even provides you the vendor of the network adapter of the scanned host. the info are stored in the mac-fingerprints database.

-x, --hexview
    to dump data in hex mode.
    TIP: while sniffing you can change the visualization mode by hitting 'a' for ascii or 'x' for hex. on line help is recalled by 'h'.

-L, --logtofile
    if used alone logs all data to specific file(s). it crates a separate file for each connection in the form "YYYYMMDD-P-IP:PORT-IP:PORT.log"
    if used with -C (collector) it creates a file with all the password sniffed in the session in the form "YYYYMMDD-collected-pass.log"

-q, --quiet
    "demonize" ettercap.
    useful if you want to log all data in background. this options will detach ettercap from the current tty and set it as a demon collecting data to files. it must be combined with -NL (or -NLC) otherwise it has no effects. Obviously the sniffing method is required, so you have to combine it with this option.

-w, --newcert
    create a new cert file for HTTPS man-in-the-middle.
    useful if you want to create a certfile with social engineered information...
    the new file is created in the current working directory. to permanently substitute the default cert file (etter.sll.crt) you have to overwrite /usr/local/share/ettercap/etter.ssl.crt

-F, --filter <FILENAME>
    load the filters chains from FILENAME
    the Filtering chains file is written in pseudo XML format. You can write by hand this file or (better) use the ncurses interface to let ettercap create it (press 'F' in the connection list interface). If you are skilled in XML parsing, you can write your own program to make a filter chain file.

    the rules are simple:

    If the proto <proto> AND the source port <source> AND the dest port <dest> AND the payload <search> match the rules, after the filter as done its action <action>, it jumps in the chain to the filter id specified in the <goto> field, else it jumps to <elsegoto>. If these field are left blank the chain is interrupted. Source and dest port equal to 0 (zero) means ANY port. You can use wildcards in the search string (see README for detail)

    NOTE: with this options filter are enabled by default, if you want to disable them on the fly, press "S" (for source) or "D" (for dest) while sniffing

    NOTE: on command line the hosts are parsed as "ettercap -F etter.filter DEST SOURCE", so the first host is bound to the dest chain and the second to the source chain.

    VERY IMPORTANT: the source chain is applied to data COMING FROM source and NOT GOING TO source. keep this in mind !! the same is for dest...

-c, --check
    check if you were poisoned by other poisoners in the LAN

TARGET SPECIFICATION
The targets are parsed on command line in reverse order. The first host is the DEST and the second is the SOURCE. this doesn't care if you are sniffing in ip based mode, because source and dest are ignored, but if you are filtering the connection this is crucial for the binding of the related filter chain.
The reverse order is due to a more intuitive interface for plugins. because some plugins need the dest host to be specified, it is simpler to type: "ettercap -Np ooze victim" than "ettercap -Np ooze NOONE victim".
The targets can be specified in dotted notation (192.168.0.1) or with their symbolic name (victim.mynet.org). Only within the -H (--hosts) option you can use wildcards.

INTERACTIVE MODE
The interactive mode (ncurses mode) is automatically selected if ettercap is launched without the option -N . Explain what you can do with it will take pages and pages... and I'm not a good writer... so if you don't know what can you do in some circumstances, simply press 'H' and a help screen will popup. there you can find a detailed list of all available commands.

EXAMPLES
Here are some examples of using ettercap.

ettercap -b

    On startup use broadcast ping to scan the LAN instead of ARP request all the subnet IPs.

ettercap -H 192.168.0.?,192.168.0.3?,192.168.0.2*

    On startup scan only the host 192.168.0.1-9, 192.168.0.30-39, 192.168.0.2, 192.168.0.20-29 and 192.168.0.200-255. if the PUBLICARP method will be selected only these host will be poisoned.

ettercap -Ozs

    Enter the interactive mode begin to collect infos in passive mode.
    In simple mode it is very useful to launch "ettercap -NOLq" and return after an hour... ;)

ettercap -s 192.168.0.1 192.168.0.2

    Enter the interactive mode and sniff only the connections between 192.168.0.1 and 192.168.0.2

ettercap -Nzs -F etter.filter 192.168.0.1 192.168.0.2

    Load filter from etter.filter and activate them on all the connection between 192.168.0.1 and 192.168.0.2 . Only Log action will be supported because it is a -s (ipsniffing) method. 192.168.0.1 is bound to the dest chain and 192.168.0.2 to the source one. To enable even the replacement and drop actions you have to launch "ettercap -Nza -F etter.filter IP IP MAC MAC"

ettercap -zs -e etter.conf

    Use the ip based sniffing mode and load the other option from the config file (etter.conf). Note that options in the file override command line.

ettercap -Nzs victim.my.net ANY:80

    Sniffs in console mode (non interactive) only the connection to and from "victim.my.net" starting or ending to all other hosts but on port 80 (www). data are dumped in ASCII mode. to dump in HEX mode add the -x option.

ettercap -NRzs remote.host.net:23 my.local.host.com

    Useful to sniffs in console mode (non interactive) all the connection on a remote LAN on which you are executing ettercap. this example will prevent to show your telnet (:23) connection from "my.local.host.com" to "remote.host.net".

ettercap -Nclt

    This will provide you the entire list of hosts in the LAN. Will check if someone is poisoning you and will report its IP. Will tell you if you are on a switched LAN or not.

ettercap -NCLzs --quiet

    This will detach ettercap from console and log to a file all the collected password. Only works if the LAN is hubbed, or if collected password are directed to your host.

ettercap -NCza -D 100 192.168.0.1 192.168.0.2 55:23:A5:B4:C7:89 00:A3:56:FE:4F:6D

    Collect password to stdout on a switched LAN. this will poison the two host 192.168.0.1 and 192.168.0.2 each other. The delay between arp replies is set to 100 sec.

ettercap -Np triton

    Launch the plugin "triton" that will try to passively search for the LAN gateway.

ettercap -Np ooze victim.mynet.org

    Launch the plugin "ooze" that will portscan the host "victim.mynet.org" that will be translated with the right IP

PLATFORMS
Linux 2.0.x 2.2.x 2.4.x
FreeBSD 4.x
OpenBSD 2.[789]
NetBSD 1.5
Mac OS X (darwin 1.3)

FILES
/usr/local/share/ettercap/etter.conf
 - the config file
/usr/local/share/ettercap/etter.dns
 - the host file for the phantom plugin
/usr/local/share/ettercap/etter.filter
 - the filter chains
/usr/local/share/ettercap/etter.passive.os.fp
 - the passive OS fingerpring database
/usr/local/share/ettercap/etter.ssl.crt
 - the SSL certificate for HTTPS m-i-t-m
/usr/local/share/ettercap/mac-fingerprints
 - the network adapter vendor database
/usr/local/share/ettercap/nmap-os-fingerprints
 - the nmap (c) Fyodor os fingerprint
/usr/local/doc/ettercap-0.6.3.1/*
 - the DOCUMENTATION

AUTHORS
Alberto Ornaghi (ALoR) <alor@users.sourceforge.net>
Marco Valleri (NaGA) <crwm@freemail.it>

AVAILABILITY
http://ettercap.sourceforge.net/download/

Or if you want to do an automatic check of the latest version try "ettercap -vy"

CVS
cvs -d:pserver:anonymous@cvs.ettercap.sf.net:/cvsroot/ettercap login
cvs -d:pserver:anonymous@cvs.ettercap.sf.net:/cvsroot/ettercap co ettercap

BUGS
Our software never has bugs.
It just develops random features. ;)

KNOWN-BUGS

- It is better that you don't launch ettercap on a host that is a gateway because man-in-the-middle attacks require to disable ip_forwarding, it may cause problem with routing. But if you want to scan the LAN passively the gateway is the right place to run ettercap... so be aware of what you are doing.

- You cannot use plugins on yourself. outgoing link layer packets are not captured by the same socket, so they will be ignored.

- While poisoning on a switched LAN, ettercap won't sniff the traffic made by your host to others. the technical reason is: otherwise ettercap will forward your packets two time (and this is not good...) the artistic reason is: why sniffing yourself with a man-in-the-middle method ? use simple sniffing instead ! ;)

- While sniffing in Public ARP mode, ettercap can "view" only one way of the connection, so some protocol dissectors can fail...

- under X11 resizing the xterm can give a corrupted visualization of the interface. SIGWINCH is *partially* supported.

- ettercap doesn't handle fragmented packets... only the first segment will be displayed by the sniffer. However all the fragments are correctly forwarded.

+ please send bug-report, patches or suggestions to <alor@users.sourceforge.net> or visit http://ettercap.sourceforge.net/forum/ and post it in the BUGS section.

+ to report a bug, recompile ettercap with 'configure --enable-debug' and attach ettercap_debug.log to the mail in which U explain the problem.

FILOLOGICAL HISTORY
"Even if blessed with a feeble intelligence, they are cruel and smart..." this is the description of Ettercap, a monster of the RPG Advanced Dungeons & Dragon. Any process forked by ettercap has a name of a monster: illithid, doppleganger, grell, dryad. Even the plugins (coded by us) are monsters.

The name "ettercap" was chosen because it has an assonance with "ethercap" which means "ethernet capture" (what ettercap actually does) and also because such monsters have a powerful poison... and you know, arp poisoning... ;)

Someone has mailed us :
"Did you know that in Dutch "etter" means "pain in the ass" or "nasty piece of work". Unfortunately, I think this applies to you, as this software will be used by numerous script kiddies to hack all kinds of services on local networks. "

I think that this is extremely true... ettercap is a "pain in the ass" for admin-kiddie. There are many way to detect and to protect against ettercap.... The first one is: DON'T GIVE ROOT ACCESS TO SCRIPT-KIDDES ON YOUR LAN! Some features were limited intentionally to work only on local network, because it is easier to protect against them locally.
Internet is not a game, we need qualified admin and programmer to make secure protocols and programs. It isn't our fault if the net is so insecure... but we can do something to harden it. Ettercap was developed with this idea in mind: if even a skript kiddies can do an hijack of the local connections, probably someone will find a solution for that !