- Home
- Network Protocol Analyzers
- Ettercap
Ettercap
What it is
Ettercap is a free, open-source suite for man-in-the-middle testing and network and host analysis. It can sniff live connections, dissect protocols actively or passively, and filter content during traffic flows. Its filtering engine supports packet-payload modifications, with filters compiled using etterfilter. Passive LAN scanning can extract host, operating-system, port, and gateway information from observed traffic. Users can work through command-line, graphical, or ncurses interfaces; listed capabilities also include PCAP support, remote capture, traffic decryption, and flow analysis. The project lists Linux and macOS platforms and self-hosted deployment, and names Debian/Ubuntu, Fedora, Gentoo, Pentoo, Mac OS X, FreeBSD, OpenBSD, and NetBSD among tested systems. The latest listed release is 0.8.4.1-Garofalo, dated April 7, 2026, with checksums for bundled-library and source-only archives. That version includes a fix for an etterfilter heap out-of-bounds read identified as CVE-2026-3606. Source builds require libraries and tools including libpcap, libnet, pthread, zlib, CMake, Flex, and Bison.
For and against
For
- Free and open source under GPL-2.0
- Offers command-line, graphical, and ncurses interfaces
- Passive scanning extracts host and gateway details
- Latest release includes a listed security fix
- Publishes SHA256 checksums for release archives
Against
- Windows Vista through Windows 10 are listed as unsupported
- Source builds require multiple libraries and tools
- No free trial is listed
The verdict
Ettercap offers multiple interfaces and a broad set of traffic and host-analysis capabilities at no cost. Check system compatibility and build requirements before choosing it.
Who it suits
Ettercap suits users doing network testing and analysis who need traffic inspection, protocol dissection, or host analysis. Source compilation requires several libraries and build tools.
Plans and prices
Ettercap
Open-source project · source code downloads
Read 4 Oct 2026 · ettercap-project.org
On the record
- Build requirements
- Source compilation requires libraries and tools including libpcap, libnet, pthread, zlib, CMake, Flex, and Bison.ettercap-project.org · read 4 Oct 2026
- Filtering
- Its integrated filtering engine lets users write filters that can modify packet payloads; filters are compiled with etterfilter.github.com · read 4 Oct 2026
- Interfaces
- The project offers command-line, graphical, and ncurses interfaces.ettercap-project.org · read 4 Oct 2026
- Network discovery
- Passive LAN scanning can extract host, operating-system, port, and gateway information from observed traffic.github.com · read 4 Oct 2026
- Platform caveat
- The about page lists Windows Vista, Windows 7, Windows 8, and Windows 10 as unsupported distributions where installation may work with additional settings.ettercap-project.org · read 4 Oct 2026
- Project and license
- The project describes itself as 100% open source and community run; its GitHub repository identifies the license as GPL-2.0.ettercap-project.org · read 4 Oct 2026
- Protocol analysis
- Ettercap supports active and passive dissection of many protocols.ettercap-project.org · read 4 Oct 2026
- Purpose
- Ettercap is a suite for man-in-the-middle testing with live connection sniffing, on-the-fly content filtering, protocol dissection, and network and host analysis.ettercap-project.org · read 4 Oct 2026
- Recent security fix
- Version 0.8.4.1 lists a fix for a heap-out-of-bounds read issue in etterfilter identified as CVE-2026-3606.ettercap-project.org · read 4 Oct 2026
- Release
- The downloads page lists version 0.8.4.1-Garofalo, released April 7, 2026, as the latest release.ettercap-project.org · read 4 Oct 2026
- Source integrity
- The downloads page publishes SHA256 checksums for both bundled-library and source-only archives of the latest release.ettercap-project.org · read 4 Oct 2026
- Support and contributions
- The project invites contributions through GitHub pull requests and directs bug reports to its GitHub bug tracker.ettercap-project.org · read 4 Oct 2026
- Supported systems
- The project lists Debian/Ubuntu, Fedora, Gentoo, Pentoo, Mac OS X, FreeBSD, OpenBSD, and NetBSD as tested distributions or systems.ettercap-project.org · read 4 Oct 2026
- Who it serves
- The project describes Ettercap as a MiTM tool and documents network and host analysis capabilities, indicating use in network testing and analysis.ettercap-project.org · read 4 Oct 2026
