Ettercap/ettercap

Health v2 · maintenance only

Adoption not part of the score

2784 stars · 535 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Ettercap is a comprehensive open-source suite for man-in-the-middle attacks on local networks. It supports live connection sniffing, on-the-fly content filtering, and active/passive dissection of many protocols, with CLI, ncurses, and GTK interfaces.

Use cases

• sniff network traffic between two hosts
• perform ARP poisoning / man-in-the-middle attacks
• intercept and modify HTTP traffic with SSLStrip
• filter and inject content into live connections
• passively dissect protocols and analyze hosts on a LAN
• capture credentials on a switched network during a pentest

When to choose

• you need a mature MITM tool for network penetration testing
• you want protocol dissection and content filtering in one suite
• you're working on Linux/BSD/macOS with libpcap available
• you need plugin extensibility for custom attack modules

When to avoid

• you need a modern GUI-focused traffic analyzer like Wireshark for passive inspection
• you're on an unsupported platform like Solaris or newer Windows without extra setup
• you want encrypted-traffic interception without dealing with certificate warnings
• you need a pure passive sniffer without MITM capabilities

Facets

application · maturity maintenance

security networking penetration-testing cli gui security penetration-testing networking windows bsd cross-platform cli man-in-the-middle packet-sniffing arp-spoofing ssl-stripping protocol-dissection network-analysis c command-line linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Ettercap/ettercap")