Skip to content
SPECIFICTION
Get listed

Ettercap

ettercap-project.org

Free plan macOSLinuxSelf-hosted
Visit ettercap-project.org
Spec score 8.0 #13 of 30 in Network Protocol Analyzers

What it is

Ettercap is a free, open-source suite for man-in-the-middle testing, live connection sniffing and network analysis. It dissects protocols actively or passively, filters packet payloads through compiled etterfilter rules, and performs network and host analysis. Passive LAN scanning can extract host, operating-system, port and gateway information from observed traffic. Command-line, graphical and ncurses interfaces are available, along with PCAP support, remote capture, traffic decryption and flow analysis. The project lists Linux and macOS platforms and supports self-hosted deployment. Tested systems include Debian/Ubuntu, Fedora, Gentoo, Pentoo, Mac OS X, FreeBSD, OpenBSD and NetBSD. The latest listed release is 0.8.4.1-Garofalo, released April 7, 2026, with a fix for an etterfilter heap out-of-bounds read identified as CVE-2026-3606. Downloads include SHA256 checksums. Source builds require libraries and tools such as libpcap, libnet, pthread, zlib, CMake, Flex and Bison. The project is community run under GPL-2.0.

Spec sheet

Purpose
Ettercap is a suite for man-in-the-middle testing with live connection sniffing, on-the-fly content filtering, protocol dissection, and network and host analysis.Read 4 Oct 2026 · ettercap-project.org
Build requirements
Source compilation requires libraries and tools including libpcap, libnet, pthread, zlib, CMake, Flex, and Bison.Read 4 Oct 2026 · ettercap-project.org
Filtering
Its integrated filtering engine lets users write filters that can modify packet payloads; filters are compiled with etterfilter.Read 4 Oct 2026 · github.com
Interfaces
The project offers command-line, graphical, and ncurses interfaces.Read 4 Oct 2026 · ettercap-project.org
Network discovery
Passive LAN scanning can extract host, operating-system, port, and gateway information from observed traffic.Read 4 Oct 2026 · github.com
Platform caveat
The about page lists Windows Vista, Windows 7, Windows 8, and Windows 10 as unsupported distributions where installation may work with additional settings.Read 4 Oct 2026 · ettercap-project.org
Project and license
The project describes itself as 100% open source and community run; its GitHub repository identifies the license as GPL-2.0.Read 4 Oct 2026 · ettercap-project.org
Protocol analysis
Ettercap supports active and passive dissection of many protocols.Read 4 Oct 2026 · ettercap-project.org
Recent security fix
Version 0.8.4.1 lists a fix for a heap-out-of-bounds read issue in etterfilter identified as CVE-2026-3606.Read 4 Oct 2026 · ettercap-project.org
Release
The downloads page lists version 0.8.4.1-Garofalo, released April 7, 2026, as the latest release.Read 4 Oct 2026 · ettercap-project.org
Source integrity
The downloads page publishes SHA256 checksums for both bundled-library and source-only archives of the latest release.Read 4 Oct 2026 · ettercap-project.org
Support and contributions
The project invites contributions through GitHub pull requests and directs bug reports to its GitHub bug tracker.Read 4 Oct 2026 · ettercap-project.org
Supported systems
The project lists Debian/Ubuntu, Fedora, Gentoo, Pentoo, Mac OS X, FreeBSD, OpenBSD, and NetBSD as tested distributions or systems.Read 4 Oct 2026 · ettercap-project.org
Who it serves
The project describes Ettercap as a MiTM tool and documents network and host analysis capabilities, indicating use in network testing and analysis.Read 4 Oct 2026 · ettercap-project.org

Plans and prices

Ettercap Free Open-source project · source code downloads Read 4 Oct 2026 · ettercap-project.org

Every Ettercap plan and price →

Strong points and limits

Strong points

  • Free open-source project
  • Active and passive protocol dissection
  • Packet-payload filtering engine
  • Command-line and graphical interfaces
  • PCAP and remote capture support

Limits

  • Windows systems are listed as unsupported
  • Source builds require several dependencies
  • No free trial is listed

Who it suits

Ettercap suits people performing network testing or analysis who need protocol dissection, packet filtering and host discovery. It is intended for Linux or macOS environments, including self-hosted setups.

Verdict

Ettercap provides broad interception and analysis functions across command-line, graphical and ncurses interfaces. Its supported-system list centers on Unix-like platforms, while Windows installation is specifically caveated.

Where Specifiction places it

Alternatives to EttercapAll alternatives →