Usage: ettercap [OPTION] [HOST:PORT] [HOST:PORT] [MAC] [MAC]
Sniffing method:
-a, --arpsniff ARPBASED sniffing (specifying two hosts)
SMARTARP (specifying one host but with the list)
PUBLICARP (specifying only one host silently)
in silent mode : must specify both IP and MAC
i.e.: ettercap -Nza IP IP MAC MAC (ARPBASED)
ettercap -Na IP MAC (SMARTARP)
ettercap -Nza IP MAC (PUBLICARP)
-s, --sniff IPBASED sniffing
you can specify the ANY ip that means ALL hosts
e.g.: ettercap -Nzs ANY:80 (sniff only http)
-m, --macsniff MACBASED sniffing
e.g.: ettercap -zm MAC1 MAC2
ettercap -Nm MAC
Off Line Sniffing:
-T, --readpcapfile OFFLINE sniffing (read packets from a file)
e.g.: ettercap -T file_dumped_from_tcpdump
-Y, --writepcapfile DUMP packets to a pcap compatible file format
e.g.: ettercap -NzsY file_to_be_dumped
General options:
-N, --simple NON-interactive mode (without ncurses)
-z, --silent silent mode (no arp storm on start up)
-O, --passive passive scanning of the LAN
-b, --broadping broadcast ping instead of arp storm on start up
-D, --delay <n sec> the delay between arp replies when poisoning (default is 30 sec)
-Z, --stormdelay <n usec> the delay between arp requests on startup (def is 1500 usec)
-B, --bufferlen <n pck> the lenght of each connection buffer.
0 for no connection buffer (def is 3)
-r, --refresh <n sec> clear internal lists after n sec (def is 300)
-S, --spoof <IP> on start up send requests with this IP
-H, --hosts <IP1[;IP2][;..]> on start up scan only these hosts
-d, --dontresolve don't resolve the IPs (speed up the startup)
-i, --iface <iface> network interface to be used
-n, --netmask <netmask> the netmask used to scan the lan
-e, --etterconf <filename> load options from a config file
-j, --loadhosts <filename> load host/mac list from a file
-k, --savehosts save host/mac list to a file
-X, --forceip disable the spoofed ICMP before poisoning
-v, --version check for the latest ettercap version
-y, --yes in combination with -v auto answer yes
-h, --help this help screen
Silent mode options (combined with -N):
-t, --proto <proto> sniff only <proto> connection (def. is tcp+udp)
proto can be: tcp, udp or all
-J, --onlypoison don't sniff, only do arp poisoning
-R, --reverse sniff all the connection but the selected one
-p, --plugin <name> run the "name" plugin ("list" for available ones)
-l, --list list all hosts in the lan
-C, --collect collect users and passwords only
this options must be used with a sniffing method
Eg: ettercap -NCzs
-f, --fingerprint <host> do active OS fingerprinting on HOST
-1, --hexview display data in hex mode
-2, --textview display data in text mode
-3, --ebcdicview display data in ebcdic mode
-L, --logtofile logs all data to specific file(s)
(for pcap use -Y)
-q, --quiet "demonize" ettercap (useful with -L)
-w, --newcert create a new SSL cert file for HTTPS dissector
-F, --filter <filename> load "filename" as the filter chain file
-c, --check check for other poisoners on the LAN
-g, --linktype tries to indentify the LAN type (switch or hub)