ettercap

Overview

Ettercap performs MITM on LAN via ARP poisoning. Sniffs, filters, and injects traffic. Plugins for DNS spoof, credential harvest.

Unified mode `-T` for CLI; `-G` GUI. `--dns` redirects domains. Requires IP forwarding enabled.

Primary use cases

• Demonstrating LAN MITM risk on flat networks
• DNS spoofing in authorized lab exercises

Key commands

ettercap -T -M arp:remote /10.0.0.1// /10.0.0.50// -i eth0

Detection / defense notes

• Dynamic ARP inspection on switches; 802.1X
• HTTPS everywhere; certificate pinning for sensitive apps

Related tools

• responder — LLMNR/NBT-NS/mDNS poisoner. Captures NetNTLM hashes on local networks.
• Wireshark — Packet dissector. Live capture and PCAP analysis with display filters and protocol decoders.