Ettercap vs Wireshark
Ettercap
ettercap-project.orgWireshark
wireshark.orgSide by side
| Figure | Ettercap | Wireshark |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Windows | — | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 2 |
| Spec score · Network Protocol Analyzers | 8.0 (#13) | 8.2 (#10) |
| Filtering | Its integrated filtering engine lets users write filters that can modify packet payloads; filters are compiled with etterfilter. | Users can filter packets using many criteria, including display filters for addresses, ports and protocols. |
| Purpose | Ettercap is a suite for man-in-the-middle testing with live connection sniffing, on-the-fly content filtering, protocol dissection, and network and host analysis. | Wireshark captures and interactively browses network traffic as a network protocol analyzer. |
Plans
In their own words
Ettercap
Ettercap is a free, open-source suite for man-in-the-middle testing, live connection sniffing and network analysis. It dissects protocols actively or passively, filters packet payloads through compiled etterfilter rules, and performs network and host analysis. Passive LAN scanning can extract host, operating-system, port and gateway information from observed traffic. Command-line, graphical and ncurses interfaces are available, along with PCAP support, remote capture, traffic decryption and flow analysis. The project lists Linux and macOS platforms and supports self-hosted deployment. Tested systems include Debian/Ubuntu, Fedora, Gentoo, Pentoo, Mac OS X, FreeBSD, OpenBSD and NetBSD. The latest listed release is 0.8.4.1-Garofalo, released April 7, 2026, with a fix for an etterfilter heap out-of-bounds read identified as CVE-2026-3606. Downloads include SHA256 checksums. Source builds require libraries and tools such as libpcap, libnet, pthread, zlib, CMake, Flex and Bison. The project is community run under GPL-2.0.
Wireshark
Wireshark is a free network protocol analyzer for capturing and examining network traffic. It supports live capture and offline analysis through a graphical interface or the TShark terminal utility, and can inspect hundreds of protocols. Display filters narrow what appears during analysis, though their syntax differs from capture filters. Wireshark reads and writes capture formats including pcap and pcapng, and can decompress gzip-compressed files. Analysis features include VoIP tools, packet coloring rules, and exports to XML, PostScript, CSV, or plain text. It can decrypt traffic for protocols including IPsec, Kerberos, SSL/TLS, WEP, and WPA/WPA2. The software is available for Linux, macOS, and Windows under GNU General Public License version 2, with no license fee for the full version. Windows packages include Npcap, which is needed for live packet capture. What a capture can show depends on the operating system, capture library, network interface, and network configuration; switched networks may not expose unicast traffic between other ports. Community help is available through a Q&A site and users mailing list.