ettercap-NG-0.7.1 (sniffer)

25/Nov/2005 tested on SuSE 9.1

Ettercap is a suite for man in the middle attacks on LAN. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols (even ciphered ones) and includes many feature for network and host analysis.

Installation

Download libnet from http://www.packetfactory.net/libnet/dist/ or download as,
```
# wget http://www.packetfactory.net/libnet/dist/libnet-1.1.2.1.tar.gz
```

Install libnet

# tar zxvf libnet-1.1.2.1.tar.gz
# cd libnet
# ./configure
# make
# make install

Download ettercap from http://prdownloads.sourceforge.net/ettercap or download as,

# wget http://switch.dl.sourceforge.net/sourceforge/ettercap/ettercap-NG-0.7.1.tar.gz

Install ettercap

# tar zxvf ettercap-NG-0.7.1.tar.gz
# cd ettercap-NG-0.7.1
# ./configure
# make
# make install

If you see error related to gtk as below, disable gtk using ./configure --disable-gtk
```
 main.c:320: error: `GTK_WRAP_WORD_CHAR' undeclared (first use in this function)
```
This is caused by a bug in the installer code (actually using Gtk+ >= 2.4 stuff). This will be solved later.

How to use Ettercap

Launch Ettercap by text mode
```
# ettercap -C
```
If you compiled with GTK, you can launch by GUI mode.
```
# ettercap -G
```
Make sure [Options]->[Promisc mode] is checked.
Select [Sniff]->[Unified sniffing...] menu.
Select a network interface.
Select [Start]->[Start sniffing] menu.
Select [Hosts]->[Scan from hosts] menu, then wait a moment while scanning the whole network for 255 hosts
Select [Mitm]->[Arp poisoning...] menu. Press Enter with no parameters.
Select [View]->[Connections] menu.
You can now see clear passwords in the subnet.
To save the logs, select [Logging]->[Log all packets and infos...] menu.

Read a log file,

# etterlog  -p -k -i --ascii logfile.eci | less

Search promiscuous mode PCs

While running ettercap, select [Plugins]->[Manage the plugins] menu.
From the plugin list, select [search_promisc 1.2] and press [Enter]
You can see "Most probably sniffing NICS" in the bottom

Back