Ettercap is a network sniffer/interceptor/logger for ethernet LANs. It supports active and passive dissection of many protocols (even ciphered ones, like SSH and HTTPS).


Data injection in an established connection and filtering on the fly is also possible, keeping the connection synchronized.

Many sniffing modes were implemented to give you a powerful and complete sniffing suite. Plugins are supported. It has the ability to check whether you are in a switched LAN or not, and to use OS fingerprints (active or passive) to let you know the geometry of the LAN.

Many long standing bugs were fixed in this version: a resource depletion issue, buffer access out-of-bounds issues, DNS dissector not working on 64-bit systems, multiple buffer overflows, multiple memory leaks, multiple files with obsolete code, SEND L3 errors experienced by some users, and a compilation error under Mac OS X Lion. The build system was updated.