ETTERCAP(8)					      ETTERCAP(8)


NAME
       ettercap 0.6.b - A multipurpose sniffer over switched LANs


SYNOPSIS
       ettercap [OPTIONS] [HOST:PORT] [HOST:PORT] [MAC] [MAC]


DESCRIPTION
       Ettercap was born as a sniffer for switched LAN (and obvi-
       ously  even "hubbed" one), but during the development pro-
       cess it has  gained  more  and  more  features  that  have
       changed it to a powerful and flexible tool for man-in-the-
       middle attacks.	It supports active and passive dissection
       of  many	 protocols (even ciphered ones) and includes many
       features for network and host analysis (such as OS finger-
       print).

       It has five sniffing methods:
       +  IPBASED,  the	 packets  are  filtered	 matching IP:PORT
       source and IP:PORT dest
       + MACBASED, packets filtered matching the source and  dest
       MAC address. (useful to sniff connections through gateway)
       + ARPBASED, uses arp poisoning to sniff	in  switched  LAN
       between two hosts (full-duplex m-i-t-m).
       +  SMARTARP,  uses  arp poisoning to sniff in switched LAN
       from a victim host to all other hosts knowing  the  entire
       list of the hosts (full-duplex m-i-t-m).
       + PUBLICARP, uses arp poison to sniff in switched LAN from
       a victim host to all other hosts (half-duplex).
       With this method the ARP replies are  sent  in  broadcast,
       but if ettercap has the complete host list (on start up it
       has scanned the	LAN)  SMARTARP	method	is  automatically
       selected,  and  the  arp replies are sent to all the hosts
       but the victim,	avoiding  conflicting  MAC  addresses  as
       reported by win2K.

       The most relevant ettercap features are:

       Characters  injection  in  an established connection : you
       can inject character to server (emulating commands) or  to
       client  (emulating  replies)  maintaining  the  connection
       alive !!

       SSH1 support : you can sniff User and Pass, and	even  the
       data of an SSH1 connection. ettercap is the first software
       capable to sniff an SSH connection in FULL-DUPLEX

       HTTPS support : you can sniff http SSL secured data... and
       even if the connection is made through a PROXY

       Remote  traffic sniffing through GRE tunnel: you can sniff
       remote traffic through a GRE tunnel from	 a  remote  cisco
       router and make mitm attack on it

       Plug-ins	 support  :  You can create your own plugin using
       the ettercap's API.

       Password collector for : TELNET, FTP, POP,  RLOGIN,  SSH1,
       ICQ,  SMB, MySQL, HTTP, NNTP, X11, NAPSTER, IRC, RIP, BGP,
       SOCKS 5, IMAP 4, VNC, LDAP, NFS, SNMP, HALF LIFE, QUAKE 3,
       MSN, YMSG (other protocols coming soon...)

       Packet  filtering/dropping:  You can set up a filter chain
       that search for a particular string (even hex) in the  TCP
       or  UDP	payload	 and  replace  it  with yours or drop the
       entire packet.

       Passive OS fingerprint: you scan passively the lan  (with-
       out sending any packet) and gather detailed info about the
       hosts in the LAN: Operating System, running services, open
       ports, IP, mac address and network adapter vendor.

       OS  fingerprint:	 you can fingerprint the OS of the victim
       host and even its network adapter (it uses  the	nmap  (c)
       Fyodor database)

       Kill  a connection: from the connections list you can kill
       all the connections you want

       Packet factory: You can create and sent packet  forged  on
       the fly. The factory let you to forge from Ethernet header
       to application level.

       Bind sniffed data to a local port You can connect to  that
       port  with a client and decode unknown protocols or inject
       data to it (only in arp based mode)



OPTIONS
       Options that make sense together	 can  generally	 be  com-
       bined.  ettercap	 will  warn  the  user	about unsupported
       option combinations.

       SNIFFING METHODS

       -a, --arpsniff
	      ARP BASED sniffing
	      This is THE sniffing method for switched	LAN,  and
	      if  you want to use the man-in-the-middle technique
	      you have to use it. In conjunction with the  silent
	      mode  (-z	 option)  you must specify two IP and two
	      MAC for ARPBASED (full-duplex) or one  IP	 and  one
	      MAC  for	PUBLICARP (half-duplex). in PUBLICARP the
	      ARP replies are sent in broadcast, but if	 ettercap
	      has  the	complete  host	list  (on start up it has
	      scanned the LAN) SMARTARP method	is  automatically
	      selected,	 and  the arp replies are sent to all the
	      hosts but the victim, and an hash table is  created
	      to  re-route  back the packet form victim to client
	      obtaining in this way a full-duplex man in the mid-
	      dle attack.
	      NOTE:  if	 you  manage  to poison a client with the
	      smart arp sniffing, remember to set  the	gateway's
	      IP  in the conf file (GWIP option) and load it with
	      the -e option, otherwise that client  will  not  be
	      able to connect to remote hosts.
	      Filters  that  have  as  action  a replacement or a
	      drop, can	 be  used  only	 with  ARPBASED	 sniffing
	      because  it  is necessary to re-adjust the sequence
	      number in full-duplex in order to maintain the con-
	      nection alive.

       -s, --sniff
	      IP BASED sniffing
	      This  is	the  good  old	style sniffing method. It
	      rocks on "hubbed"	 LAN,  but  useless  on	 switched
	      ones.  You  can  choose  the target specifying only
	      source, only dest, with or without port, or nothing
	      (to  sniff  all  connections).  A	 special ip "ANY"
	      means from or to every host.

       -m, --macsniff
	      MAC BASED sniffing
	      Very useful to sniff TCP traffic with remote hosts.
	      On  hubbed  LANs	if you want to sniff a connection
	      through a gateway is useless to  specify	the  vic-
	      tim's  ip	 and the gateway's ip, because the packet
	      are for an external host, not for the  gateway.  So
	      you  can	use this method.  Simply specify the vic-
	      tim's MAC and the gateway's MAC and  you	will  see
	      all the connections from and to the Internet.


       OFF LINE SNIFFING

       -T, --readpcapfile <FILE>
	      OFF LINE sniffing
	      With this option enabled, ettercap will sniff pack-
	      ets from a pcap compatible file instead of  captur-
	      ing from the wire.
	      This  is useful if you have a file dumped from tcp-
	      dump or ethereal and you want to make  an	 analysis
	      (search  for  passwords  or passive fingerprint) on
	      it.

       -Y, --writepcapfile <FILE>
	      DUMP packet to a pcap file
	      This is useful if you have to  use  active-sniffing
	      (arp poison) on a switched LAN but you want to ana-
	      lyze the packets with tcpdump or ethereal. You  can
	      use  this	 option to dump the packets to a file and
	      then load it into your favourite application.



       GENERAL OPTIONS

       -N, --simple
	      NON interactive mode (without ncurses)
	      This method is useful if you want to launch  etter-
	      cap  from	 a  script  or	if  you already know some
	      informations of your  target  or	if  you	 want  to
	      launch  ettercap	in  background collecting data or
	      password for you (in combination with  the  --quiet
	      option).
	      Some  features  are  not	available in this method,
	      obviously the ones which requires interaction  with
	      the  user, such as characters injection. But others
	      (for example filtering) are fully supported, so you
	      can  set	up  ettercap to poison two host (a victim
	      and its gateway) and to filter all  its  connection
	      on the port 80 and replace some string with others,
	      all its traffic to the Internet will be changed  as
	      you wish.

       -z, --silent
	      start in silent mode (no arp storm on start up)
	      If  you want to launch ettercap with a non invasive
	      method (some NIDS may raise a warn if they  detects
	      too  much	 arp  request).	 You have to know all the
	      requested data of the target in order to	use  this
	      options.	For  example  if  you  want to poison two
	      host, you need the two IP and the two MAC addresses
	      of  the victims.	If you select ipsniff or macsniff
	      this method is automatically selected, because  you
	      don't need to know the list of the host in the LAN.
	      To know the entire list of the hosts use	"ettercap
	      -Nl", but remember that it is a invasive method.

       -O, --passive
	      Collect infos in passive mode. This method WILL NOT
	      SEND ANY packet on  the  wire.   It  will	 put  the
	      interface	 in promiscuous mode and look for packets
	      passing through it.  every interesting packet  (SYN
	      or SYN+ACK) is analyzed and used to make a complete
	      map of the LAN.
	      The infos collected are: IP and MAC of  the  hosts,
	      type  of Operating System (passive OS fingerprint),
	      network adapter vendor and running services. (for a
	      technical	 description refer to README) In the list
	      are show even other infos: "GW" if the  host  is	a
	      GateWay, "NL" if the IP is not belonging to the LAN
	      and "RT" if the host act as a router.
	      Useful if you want to make a start up host list  in
	      complete	passive	 mode,	when you are satisfied of
	      the collected infos, you	can  convert  it  to  the
	      startup  host  list  by  simply press 'C', and then
	      work as usual.
	      The description of its functionality in simple mode
	      is explained in the next section.

       -b, --broadping
	      use  a broadcast ping instead of arp storm on start
	      up.
	      this method is less intrusive, but even less  accu-
	      rate.  some hosts will not respond at the broadcast
	      ping (es. Windows) so they remain invisible to this
	      method. Useful if you want to scan a LAN with Linux
	      hosts. As usual you can combine  this  option  with
	      --list to have a list of the hosts "ettercap -Nlb"

       -D, --delay <n sec>
	      the delay in seconds between the arp replies if you
	      have selected an ARP poison sniffing  method.  This
	      is  useful if you want to be less aggressive in the
	      poisoning. On many OS the default validity interval
	      of  the arp cache is more than a minute (on FreeBSD
	      is 1200 sec).
	      The default delay value is 30 sec.

       -Z, --stormdelay <n usec>
	      the delay in micro-seconds between the arp  request
	      on  arp  storm  at start up.  This is useful if you
	      want to be less aggressive in  the  scanning.  Many
	      IDS  will	 report	 massive  arp request, but if you
	      send them in a slower rate, they	will  not  report
	      any strange behavior.
	      The default delay value is 1500 usec.

       -r, --refresh <n sec>
	      ettercap	will refresh its internal connection list
	      after n seconds.	Set a low value if you have  huge
	      traffic load.
	      The default delay value is 300 sec.

       -B, --bufferlen <n pck>
	      the  lenght  of each connection buffer. 0 will dis-
	      able connection buffers.	Last n	packets	 of  each
	      connection will be saved for visualization and log-
	      ging from ncurses interface.
	      The default value is 3.

       -S, --spoof <IP>
	      If you want to elude some IDS, you  can  specify	a
	      spoofed  IP  used to scan the LAN with arp request.
	      The source MAC can't be spoofed because a well con-
	      figured switch will block your request.

       -H, --hosts <IP1[;IP2][;IP3][;...]>
	      on start up, scan only these hosts.
	      this  is	useful if you want to use an ARP scanning
	      of the LAN but only on certain  IPs.   so	 you  can
	      benefit  from  a	ARP scan but remaining less inva-
	      sive.  Useful even if you want to do PUBLIC ARP but
	      you want to poison only specific hosts.  since with
	      a list PUBLIC ARP	 is  automatically  converted  to
	      SMARTARP,	 only these host will be poisoned and you
	      can leave untouched the arp  caches  of  the  other
	      hosts.
	      the  IP  list  must be in dotted notation and sepa-
	      rated by semi-colon (without blank  spaces  between
	      them),  you  can	use  range ip (use the hyphen) or
	      single ip list (use the comma).
	      EXAMPLES:

		 192.168.0.2-25	  --> from 2 to 25

		 192.168.0.1,3,5  --> host 1, 3 and 5

		 192.168.0-3.1-10;192.168.4.5,7	 -->  will   scan
	      from   1	 to   10  in  the  192.168.0,  192.168.1,
	      192.168.2, 192.168.3 subnet and hosts 5  and  7  in
	      the 192.168.4

       -d, --dontresolve
	      don't  resolve  IPs  on start up. this is useful if
	      you experience an insane "Resolving n hostnames..."
	      message on start up. This is due to a very slow DNS
	      in your environment.

       -i, --iface <IFACE>
	      network interface to be used for all the operation.
	      you  can	even  specify network aliases in order to
	      scan a subnet with different ip form  your  current
	      one.

       -n, --netmask <NETMASK>
	      the  netmask used to scan the LAN. (in dotted nota-
	      tion). the default is your  current  ifconfig  net-
	      mask. but your netmask is for example 255.255.0.0 I
	      encourage you to specify a more restrictive one, if
	      you managed to do an ARP scanning on start up.

       -e, --etterconf <FILENAME>
	      use the config file instead of command line options
	      etter.conf example file is packaged in the tarball,
	      refer to it to know how to write a config file. all
	      the instruction are written in  this  example.  via
	      the  conf file you can disable selectively one pro-
	      tocol dissector or move it on one other port.
	      command line options and config file can	be  mixed
	      for much flexibility, but remember that the options
	      in the config file override the command line, so if
	      in  etter.conf  you have specified IFACE: eth0, and
	      you launch "ettercap -i  eth1  -e	 etter.conf"  the
	      selected iface will be eth0.
	      NOTE:  the "-e etter.conf" options has to be speci-
	      fied after all other options.

       -g, --linktype
	      this flag has two complementary function.	 so  mind
	      it !
	      if  used	in  interactive mode it DOESN'T check for
	      lan type. On the other hand, if used in conjunction
	      with command line mode (-N) it DOES a check to dis-
	      cover if you are on a switched LAN or not...  Some-
	      times  if	 there	are  only 2 hosts in the lan this
	      discovery method can fail.

       -j, --loadhosts <FILENAME>
	      it is used to load an hosts list from a  file  cre-
	      ated by the -k option. (see below)

       -k, --savehosts
	      saves  the  hosts	 list  to a file. useful when you
	      have many hosts and you don't want  to  do  an  arp
	      storm  at startup any time you use ettercap. simply
	      use this options and dump the list to a file,  then
	      to  load	the information from it use the -j <file-
	      name> option.
	      the file is in the form "netaddress_netmask.ehl"

       -X, --forceip
	      disable the spoofed ICMP packet before poisoning.

       -v, --version
	      check for the latest ettercap version.
	      All operation are under your  control.  Every  step
	      requires	a  user	 confirmation.	 With this option
	      ettercap	will   connect	 to   the   http://etter-
	      cap.sourceforge.net:80  web  site	 and  ask for the
	      page /latest.php. then the result	 are  parsed  and
	      compared	with  your current version. If there is a
	      newer version available, ettercap will ask  you  if
	      you want to wget it. (wget must be in the path).
	      If  you want to automatically answer yes at all the
	      question add the option -y

       -h, --help
	      prints the help screen with a short summary of  the
	      available options.

       SILENT MODE OPTIONS (only combined with -N)

       -t, --proto <PROTO>
	      sniff  only  PROTO  packets (default is TCP + UDP).
	      This option is only useful in "simple" mode, if you
	      start ettercap in interactive mode both TCP and UDP
	      are sniffed.
	      PROTO can be "tcp", "udp" or "all" for both.

       -J, --onlypoison
	      With this option ettercap wont sniff anything,  but
	      it  only poison the victims.  This can be useful if
	      you want to poison with  ettercap	 and  sniff  with
	      ethereal	or  tcpdump.  (remember	 in  this case to
	      enable IP_forwarding).

	      Another use is for multitarget sniffing.
	      As you know, with ettercap you can sniff connection
	      between  two  target  (ARP  BASED) or to and from a
	      single target (SMART ARP). With this option you can
	      sniff from couples of target at a time (as you have
	      launched many instance together).

	      Launch the first instance in SMART ARP, and use the
	      -H  options  to  limitate	 the smart feature to the
	      hosts you want to poison (remember that if you want
	      to  involve  the Gateway in the poisoning, you MUST
	      select it	 from  the  smart  arp	instance).   Then
	      launch the other "ettercap -J".

       -R, --reverse
	      sniff all the connection but the selected one. This
	      option is useful if you are  using  ettercap  on	a
	      remote  machine and you want to sniff all the traf-
	      fic  but	you  connection	 from  local  to  remote,
	      because  including  it will sniff even the ettercap
	      output and it will be screwed up...

       -O, --passive
	      Collect infos in passive mode as described  in  the
	      previous	section.   In simple mode we can use this
	      option in many mode.
	      "ettercap -NO" will start ettercap in semi-interac-
	      tive  mode,  hit 'h' for help.  You can view or log
	      to a file a detailed report of the collected infos,
	      or simply view each alert of analyzed packet.
	      "ettercap	 -NOL"	as above but it log automatically
	      the data into a file every 5 min.
	      "ettercap -NOLq" deminizes ettercap and  log  to	a
	      file  every  5  minutes.	Go  away  and  smoke your
	      cigarette... return and a complete  report  of  the
	      lan is there waiting for you... ;)

       -p, --plugin <NAME>
	      run the external plugin "NAME".
	      most  plugins need a destination host. simply spec-
	      ify it after plugin name, in fact hosts are  parsed
	      on  command  line	 as  first  the	 DEST  and so the
	      SOURCE.
	      To have a list of the  available	external  plugins
	      use "list" (without quotes) as plugin name.

	      Since ettercap 0.6.2 hooking plugins system is pro-
	      vided, so some plugins are not executed as a  sepa-
	      rated  program, they can interact with ettercap and
	      can be enabled or disabled  via  the  interface  or
	      conf file.

	      More  detailed  info about plugins and about how to
	      write your own  are  found  in  the  README.PLUGINS
	      file.

       -l, --list
	      lists  all the hosts in the LAN, reporting each MAC
	      address.
	      Commonly combined options	 are  -b  (for	broadcast
	      ping) and -d (don't resolve hostname).

       -C, --collect
	      collect all users and password from the hosts spec-
	      ified on command line.
	      Password collector are  configured  in  the  config
	      file (etter.conf), if you want you can disable them
	      selectively or move them on  other  port.	 This  is
	      useful  if  you  don't want to sniff SSH connection
	      (the key change alert will raise suspects) but want
	      to  sniff all other supported protocols. Or even if
	      you know that a host has the telnet service on port
	      4567, simply move the telnet dissector on 4567/tcp

       -f, --fingerprint <HOST>
	      do OS fingerprinting on HOST.
	      This  option  uses  the  same database and the same
	      method  used  by	nmap  (c)  Fyodor   <fyodor@inse-
	      cure.org> so I report a piece of its man page :

	      This  option  activates  remote host identification
	      via TCP/IP fingerprinting. In other words, it  uses
	      a	 bunch	of techniques to detect subtleties in the
	      underlying operating system network  stack  of  the
	      computers	 you  are scanning. It uses this informa-
	      tion to create a	'fingerprint' which  it	 compares
	      with  its	 database  of  known OS fingerprints (the
	      nmap-os-fingerprints file) to decide what	 type  of
	      system you are scanning.

	      the  -f options even provides you the vendor of the
	      network adapter of the scanned host.  the info  are
	      stored in the mac-fingerprints database.

       -1, --hexview
	      to dump data in hex mode.
	      TIP:  while  sniffing you can change the visualiza-
	      tion mode by hitting 'a' for ascii or 'x' for  hex.
	      on line help is recalled by 'h'.

       -2, --textview
	      to dump data in text mode.

       -3, --ebcdicview
	      to dump data in ebcdic mode.

       -L, --logtofile
	      if used alone logs all data to specific file(s). it
	      crates a separate file for each connection  in  the
	      form  "YYYYMMDD-P-IP:PORT-IP:PORT.log" (under unix)
	      and "P-IP[PORT]-IP[PORT].log" under windows due  to
	      filename limitations.
	      if  used with -C (collector) it creates a file with
	      all the password sniffed in the session in the form
	      "YYYYMMDD-collected-pass.log"

       -q, --quiet
	      "demonize" ettercap.
	      useful  if  you want to log all data in background.
	      this options will detach ettercap from the  current
	      tty and set it as a demon collecting data to files.
	      it must be combined with -NL (or -NLC) otherwise it
	      has  no  effects.	 Obviously the sniffing method is
	      required, so you	have  to  combine  it  with  this
	      option.

       -w, --newcert
	      create a new cert file for HTTPS man-in-the-middle.
	      useful if you want to create a certfile with social
	      engineered information...
	      the  new	file  is  created  in the current working
	      directory. to permanently	 substitute  the  default
	      cert  file  (etter.sll.crt)  you	have to overwrite
	      /usr/local/share/ettercap/etter.ssl.crt

       -F, --filter <FILENAME>
	      load the filters chains  from FILENAME
	      the Filtering chains file is written in pseudo  XML
	      format. You can write by hand this file or (better)
	      use the ncurses interface to let ettercap create it
	      (press  'F'  in  the connection list interface). If
	      you are skilled in XML parsing, you can write  your
	      own program to make a filter chain file.

	      the rules are simple:

	      If  the  proto <proto> AND the source port <source>
	      AND the dest port <dest> AND the	payload	 <search>
	      match  the  rules,  after	 the  filter  as done its
	      action <action>, it jumps in the chain to the  fil-
	      ter id specified in the <goto> field, else it jumps
	      to <elsegoto>.  If these field are left  blank  the
	      chain is interrupted. Source and dest port equal to
	      0 (zero) means ANY port. You can use  wildcards  in
	      the search string (see README for detail)

	      NOTE:  with  this	 options  filter  are  enabled by
	      default, if you want to disable them  on	the  fly,
	      press  "S"  (for	source)	 or  "D" (for dest) while
	      sniffing

	      NOTE: on command	line  the  hosts  are  parsed  as
	      "ettercap	 -F  etter.filter  DEST	 SOURCE",  so the
	      first host is bound to the dest chain and the  sec-
	      ond to the source chain.

	      VERY IMPORTANT: the source chain is applied to data
	      COMING FROM source and NOT GOING	TO  source.  keep
	      this in mind !! the same is for dest...

       -c, --check
	      check  if	 you  were poisoned by other poisoners in
	      the LAN




TARGET SPECIFICATION
       The targets are parsed on command line in  reverse  order.
       The  first  host is the DEST and the second is the SOURCE.
       this doesn't care if you are sniffing in	 ip  based  mode,
       because	source	and dest are ignored, but if you are fil-
       tering the connection this is crucial for the  binding  of
       the related filter chain.
       The reverse order is due to a more intuitive interface for
       plugins. because some plugins need the  dest  host  to  be
       specified,  it is simpler to type: "ettercap -Np ooze vic-
       tim" than "ettercap -Np ooze NOONE victim".
       The  targets  can  be   specified   in	dotted	 notation
       (192.168.0.1)   or   with   their   symbolic   name  (vic-
       tim.mynet.org). Only within the -H  (--hosts)  option  you
       can use wildcards.



INTERACTIVE MODE
       The  interactive	 mode  (ncurses	 mode)	is  automatically
       selected if ettercap is launched without the option  -N	.
       Explain	what  you  can	do  with  it  will take pages and
       pages... and I'm not a good writer... so if you don't know
       what  you  can  do in some circumstances, simply press 'H'
       and a help  screen  will	 popup.	 There	you  can  find	a
       detailed list of all available commands.



WORKING OFF-LINE
       If  you want to analize a file saved with tcpdump or ethe-
       real in the libpcap format, you can use the Sprite plugin.
       You  can	 use  it  to recontruct the connections list, the
       password collecting process or the Passive OS Fingerprint.
       Simply  you  have to specify the file in the -T option and
       then use ettercap as you were sniffing from the	net.   To
       save  a	tcpdump	 file  for  further  analysis  use the -Y
       option.


EXAMPLES
       Here are some examples of using ettercap.

       ettercap -b

	      On startup use  broadcast	 ping  to  scan	 the  LAN
	      instead of ARP request all the subnet IPs.

       ettercap -H 192.168.0.?,192.168.0.3?,192.168.0.2*

	      On   startup  scan  only	the  host  192.168.0.1-9,
	      192.168.0.30-39, 192.168.0.2,  192.168.0.20-29  and
	      192.168.0.200-255.   if  the PUBLICARP method is be
	      selected only these host will be poisoned.

       ettercap -Ozs

	      Enter the interactive mode begin to  collect  infos
	      in passive mode.
	      In  simple mode it is very useful to launch "etter-
	      cap -NOLq" and return after an hour... ;)

       ettercap -s 192.168.0.1 192.168.0.2

	      Enter the interactive mode and sniff only the  con-
	      nections between 192.168.0.1 and 192.168.0.2

       ettercap -Nzs -F etter.filter 192.168.0.1 192.168.0.2

	      Load  filter from etter.filter and activate them on
	      all  the	 connection   between	192.168.0.1   and
	      192.168.0.2  .  Only  Log	 action will be supported
	      because	it   is	  a   -s   (ipsniffing)	  method.
	      192.168.0.1   is	 bound	to  the	 dest  chain  and
	      192.168.0.2 to the source one.  To enable even  the
	      replacement  and	drop  actions  you have to launch
	      "ettercap -Nza -F etter.filter IP IP MAC MAC"


       ettercap -zs -e etter.conf

	      Use the ip based sniffing mode and load  the  other
	      option  from  the	 config	 file (etter.conf).  Note
	      that options in the file override command line.

       ettercap -Nzs victim.my.net ANY:80

	      Sniffs in console mode (non interactive)	only  the
	      connection  to and from "victim.my.net" starting or
	      ending to all other hosts but  on	 port  80  (www).
	      data  are dumped in ASCII mode. to dump in HEX mode
	      add the -x option.

       ettercap -NRzs remote.host.net:23 my.local.host.com

	      Useful to sniffs in console mode (non  interactive)
	      all the connection on a remote LAN on which you are
	      executing ettercap. this example	will  prevent  to
	      show    your    telnet	(:23)	connection   from
	      "my.local.host.com" to "remote.host.net".

       ettercap -Nclg

	      This will provide you the entire list of	hosts  in
	      the LAN. Will check if someone is poisoning you and
	      will report its IP. Will tell you if you are  on	a
	      switched LAN or not.

       ettercap -NCLzs --quiet

	      This will detach ettercap from console and log to a
	      file all the collected password.	Only works if the
	      LAN   is	hubbed,	 or  if	 collected  password  are
	      directed to your host.

       ettercap -NCza -D 100 192.168.0.1  192.168.0.2
       55:23:A5:B4:C7:89 00:A3:56:FE:4F:6D

	      Collect password to stdout on a switched LAN.  this
	      will   poison   the   two	  host	 192.168.0.1  and
	      192.168.0.2  each	 other.	 The  delay  between  arp
	      replies is set to 100 sec.

       ettercap -Np triton

	      Launch  the  plugin  "triton" that will try to pas-
	      sively search for the LAN gateway.

       ettercap -Np ooze victim.mynet.org

	      Launch the plugin "ooze"	that  will  portscan  the
	      host  "victim.mynet.org"	that  will  be translated
	      with the right IP

PLATFORMS
       Linux 2.0.x  2.2.x  2.4.x
       FreeBSD 4.x
       OpenBSD 2.[789] 3.0
       NetBSD 1.5
       Mac OS X (darwin 1.3.x 1.4.x 5.x)
       Windows NT4  2000  XP

FILES
       /usr/local/share/ettercap/etter.conf
	- the config file
       /usr/local/share/ettercap/etter.dns
	- the host file for the phantom plugin
       /usr/local/share/ettercap/etter.filter
	- the filter chains
       /usr/local/share/ettercap/etter.mime
	- the mime types use by the Thief plugin
       /usr/local/share/ettercap/etter.passive.os.fp
	- the passive OS fingerpring database
       /usr/local/share/ettercap/etter.ssl.crt
	- the SSL certificate for HTTPS m-i-t-m
       /usr/local/share/ettercap/mac-fingerprints
	- the network adapter vendor database
       /usr/local/share/ettercap/nmap-os-fingerprints
	- the nmap (c) Fyodor os fingerprint
       /usr/local/doc/ettercap-0.6.b/*
	- the DOCUMENTATION



AUTHORS
       Alberto Ornaghi (ALoR) <alor@users.sourceforge.net>
       Marco Valleri (NaGA) <crwm@freemail.it>



AVAILABILITY
       http://ettercap.sourceforge.net/download/

       Or if you want to do an automatic check of the latest ver-
       sion try "ettercap -vy"


CVS
       cvs	   -d:pserver:anonymous@cvs.ettercap.sf.net:/cvs-
       root/ettercap login
       cvs	   -d:pserver:anonymous@cvs.ettercap.sf.net:/cvs-
       root/ettercap co ettercap


BUGS
       Our software never has bugs.



ettercap 0.6.b		     20030809			       14





ETTERCAP(8)					      ETTERCAP(8)


       It just develops random features.   ;)

       KNOWN-BUGS

       -  It  is  better that you don't launch ettercap on a host
       that  is	 a  gateway  because  man-in-the-middle	  attacks
       require	to  disable  ip_forwarding,  it may cause problem
       with routing. But if you want to scan  the  LAN	passively
       the  gateway  is	 the right place to run ettercap... so be
       aware of what you are doing.

       - You cannot use plugins on yourself. outgoing link  layer
       packets	are not captured by the same socket, so they will
       be ignored.

       - While poisoning on a switched LAN, ettercap won't  sniff
       the  traffic  made  by  your host to others. the technical
       reason is: otherwise ettercap will  forward  your  packets
       two time (and this is not good...) the artistic reason is:
       why sniffing yourself with a  man-in-the-middle	method	?
       use simple sniffing instead ! ;)

       -  While	 sniffing in Public ARP mode, ettercap can "view"
       only one way of the connection, so some	protocol  dissec-
       tors can fail...

       -  under X11 resizing the xterm can give a corrupted visu-
       alization of the interface. SIGWINCH is	*partially*  sup-
       ported.

       -  ettercap  doesn't handle fragmented packets... only the
       first segment will be displayed by  the	sniffer.  However
       all the fragments are correctly forwarded.

       +  please  send	bug-report,  patches  or  suggestions  to
       <alor@users.sourceforge.net>   or   visit    http://etter-
       cap.sourceforge.net/forum/   and	 post it in the BUGS sec-
       tion.

       + to report a  bug,  recompile  ettercap	 with  'configure
       --enable-debug'	and attach ettercap_debug.log to the mail
       in which U explain the problem.



FILOLOGICAL HISTORY
       "Even if blessed with  a	 feeble	 intelligence,	they  are
       cruel  and smart..."  this is the description of Ettercap,
       a monster of the RPG Advanced Dungeons & Dragon.	 Any pro-
       cess forked by ettercap has a name of a monster: illithid,
       doppleganger, grell, dryad. Even the plugins (coded by us)
       are monsters.

       The name "ettercap" was chosen because it has an assonance
       with  "ethercap"	 which	means  "ethernet  capture"  (what
       ettercap	 actually  does)  and  also because such monsters
       have a powerful poison... and you know,	arp  poisoning...
       ;)

       Someone has mailed us :
       "Did  you  know	that  in Dutch "etter" means "pain in the
       ass" or "nasty piece of work". Unfortunately, I think this
       applies	to you, as this software will be used by numerous
       script kiddies to hack all kinds of services on local net-
       works. "

       I think that this is extremely true... ettercap is a "pain
       in the ass" for admin-kiddie. There are many way to detect
       and  to	protect	 against  ettercap....	The first one is:
       DON'T GIVE ROOT ACCESS  TO  SCRIPT-KIDDIES  ON  YOUR  LAN!
       Some  features  were limited intentionally to work only on
       local network, because it is  easier  to	 protect  against
       them locally.
       Internet	 is  not a game, we need qualified admin and pro-
       grammer to make secure protocols and  programs.	It  isn't
       our fault if the net is so insecure... but we can do some-
       thing to harden it.  Ettercap was developed with this idea
       in  mind: if even a skript kiddies can do an hijack of the
       local connections, probably someone will find  a	 solution
       for that !


The Lord Of The (Token)Ring
       (the fellowship of the packet)

       "One Ring to link them all, One Ring to ping them,
	one  Ring  to  bring  them  all and in the darkness sniff
       them."

ettercap 0.6.b		     20030809			       16


