Slashdot Mirror
The men behind ettercap-NG
An anonymous reader writes "In 2001 two Italians released the first beta version of ettercap, a network protocol analyzer. Ettercap is now covered in most security books. It's number 9 in the Top 75 Security Tools list of the Nmap Hackers mailing list. This summer they released ettercap-NG, which was completely rewritten from scratch with better, modular code, making it easier to add new features and write and submit patches. NewsForge recently caught up with its authors for an Interview."
Where is the link to ettercap?
Thats one way to deal with windows people
I agree re: ethereal.
I don't know why it wasn't linked to in the article, but here you go:
Homepage: http://ettercap.sourceforge.net/
Description: A suite for man in the middle attacks and network mapping
All too often, software announcements mention just the name of the item and not what it is or why it's interesting. As an example, compare this recent summary for Zope.
Not everyone's heard of Ettercap; this summary says what it is (network protocol analyzer) and also why it's important (in top ten of security tools). I hope to see more summaries of this caliber on Slashdot.
You're comparing apples and oranges. Ettercap is not just a packet dumping/protocol analyzer tool like tcpdump. It has many active features, like arp-cache poisoning, data injection etc.
I agree with regards to tcpdump, its small and relatively good at its job. That said, I mostly use it to capture packets and dump them to a file for analysis with other programs (ntop, snort, and tcpdump itself)
Ethereal? Its nice if it wasn't ridden with bugs and security issues. More alternatives in this market are a good thing, especially when talking about gui based capture tools.
The other top tools.
ettercap has almost nothing to do with ethereal, tcpdump or any other general-purpose sniffers. It's for a men-in-the-middle attack, with ARP poisoning and other techniques, not for simply sniffing packets that already come to your NIC.
It can sniff in a switched enviroment. You can't do this whith TCPDUMP !!!
Ettercap is evil :)
It's more of a hacking tool than a network analizer. It allows you to sniff switched networks, perform man-in-the-middle-attacks, it looks for passwords, etc.
We chose the GPL because it's the most used, so it has to be the best.
I have a nice Windows XP CD to sell you, guys.
--
Glass, total pwnage.
err? If it can be broken into, why not do it yourself first and fix the problem instead of letting someone else do it?
I don't know why it wasn't linked to in your post, but here you go:
Homepage: http://ettercap.sourceforge.net/
"If a frog had side pockets, he'd carry a hand gun" - Dan Rather
Its man in the middle feature lets me catch botnets on my college campus (I work in the IT dept.) and shut them down immediately.
"...won't you stay a while"
"Look Lois, the two symbols of the Republican Party: an elephant, and a fat white guy who is threatened by change."
"anyone care to justify this application, which seems to be yet another blackhat/script kiddy tool?"
:)
Anyone who's smart enough to use it effectively deserves results
Seriously, a swiss army knife for kiddies is by definition a swiss army knife for security testers and system managers. I'd prefer for hacking tools to be available for all rather than just for the malicious portion of the online population.
For the love of God, please learn to spell "ridiculous"!!!
Actually you only need a poisoning tool for that matters, not that tcpdump have it, but is not that hard to acomplish actually
I'm positive, don't belive me look at my karma
Because I use linkification which frees me from having to worry about such mundalities.
/. comments when idiots like me forget to put the anchor tags in ;)
I find its main use is for reading
As a bit of a sidenote, does anyone know of a program like Windows' Sniffer that has a "dashboard" type of applet which display the current packets per second going through an interface, or any other pps monitor (text or graphical)?
The new 3.0 release of the excellent Ultimate Boot CD has Ettercap included with the INSERT live CD. If you're a Windows user, it's an easy way to boot into Linux and try it out without having to worry about compiling and what not.
What I should have said was nothing.
Can tcpdump take ownership of a connection you are sniffing (for example, take control of a telnet session between two hosts, anc close the connection to one of the two host while retaining the one with th other)?
ettercap can.
and have used it for long for time. I tend to use it for evil and not good though =/. Being on a switched enviroment at work makes it the perfect happy fun time tool! :-)
ettercap has a nice ncurses and gtk2 'gui' for teh win
It is perfectly legal for me to do anything I like on my network. What more justification do I need?
Perhaps we should ban debuggers too, because all we can use them for is breaking into commercial software...
iptraf does this pretty well. You can have a look at screenshots of it in action here.
You're being deliberately obtuse in your statement about debuggers. A debugger is most frequently used to debug a program that you're working on. The fact that it can be and is sometimes used to hack somebody else's work is an unfortunate side effect. ... you'd already know what you were saying.
A protocol sniffer on the other hand is useful only for intruding on other people's IMs/e-mails and grabbing their passwords. If it was your own traffic you were sniffing, you wouldn't need to
Nice try at rationalising blatant criminal behaviour though, Mr. slashbot.
Yes I would. Used ethereal for that purpose just yesterday.
We were making our system interface with a server, and the documentation we got was - well, very little. The test program worked, but the main program didn't. Only when we started comparing packed dumps, did we notice the four bytes that were different.
The program did something similar, it would monitor network traffic and show you all the images that were being transmitted. So you could run it and figure out what sites people were surfing and stuff like that. It was very cool, but I have been unable to find it recently and I don't remember the name. Can anyone help me? Any programs that do this? Thanks.
Comment forecast: Bits of genius surrounded by a sea of mediocrity.
just read what the authors replied... even dynamite is TODAY primarily used in WARS, but Nobel invented it to help the miners...
ettercap is useful to filter and inject bits into connections of your lan... to test network applications, to map the hosts in the lan passively... don't focus your attention only on the password collection... this is a "side effect". this was done to open the eyes of the users that are still using plain text protocols...
I sniff traffic all the time using ethereal, etherpeek, and tcpdump. I do this to verify traffic from remote customers, help debug developers custom applications, and estimate bandwidth usage by application. I dont have a need for ettercap, man in the middle attacks, or arp poisoning though. Sniffers do have many legitimate uses other than spying on email and IM sessions.
Hmmm, so I can alter my XBox without any legal problems? I paid for it.
What about these DVDs and CDs I bought, I can rip them onto my laptop so I don't have to carry my CDs and DVDs around? I bought these too.
So I can burn down my own house? I own it... ah... oh... well half of it, the bank owns the other bit (d'oh). If I select the half I own, say the bathroom and the box room; I can trash that with impunity.
See my cat...
Ownership doesn't necessarily convey infinite rights, just demans good stewardship. Don't forget to tell Bush...
apart from being ugly it is quite useful app and available in most distros as well
so I can alter my XBox without any legal problems?
If you can't then there is something seriously wrong with the laws of your country.
What about these DVDs and CDs I bought, I can rip them onto my laptop so I don't have to carry my CDs and DVDs around?
Again, you *should* be able to - if you live under an oppresive regime that disallows such action, then you should be working to bring your country into the 20th century.
You want gkrellm.
It's great. If you run Red Hat though, they removed it from EL3, because such a useful server monitoring program has no place in the enterprise. (I.E. They are fucking retarded).
You can use the packages for RH9 though.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
Its all in the user, net tools (i.e. ettercap) don't kill networks, people kill networks.
Don't be a Hem, find some new cheese.
You're being deliberately obtuse in your statement about protocol sniffers. How do you know what I do with a sniffer on my network?
Protocol sniffers do not invade peoples privacy, people do.
Sure, you just void your warrenty.
What about these DVDs and CDs I bought, I can rip them onto my laptop so I don't have to carry my CDs and DVDs around? I bought these too.
You can back them up, or convert them to some other format for your convinience.
So I can burn down my own house? I own it... ah... oh... well half of it, the bank owns the other bit (d'oh). If I select the half I own, say the bathroom and the box room; I can trash that with impunity.
You can do what you want with your house with in the limit of the law.
Ownership doesn't necessarily convey infinite rights, just demans good stewardship. Don't forget to tell Bush...
Ownership allows you to do what you want with your property as long as it is within the law. Nothing demands good stewardship, unless you count community peer pressure.
And I did tell Bush, I voted for him. :-)
Is ettercap uttercrap?
Soooo... your theory behind network intrusion testing is that you shouldn't try to break into the network while you're doing it, and therefore any tool that would help you do it must be useless or evil?
Remind me to never hire you for anything related to network security testing....
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
I think it was the terminal font that was ugly and not the program.
"The world only exists in your eyes. You can make it as big or as small as you want." - F Scott Fitzgerald
By "real" I mean you get paid to admin a box other than your own.
I'm just curious. I tend to avoid the "dark gray" tools like this and stick to the "light gray" tools like nmap.
So have you used this tool? In what capacity? Penetration testing? Just poking around the network? For your own education or did you use the info in a report or to solve a specific problem? Etc?
Just wondering if I should take the time to add it to my toolbox.
Old fat spider
spinning in a tree!
Old fat spider
can't see me!
Attercop! Attercop!
Won't you stop,
Stop your spinning
and look at me!
Old Tomnoddy, all big body,
Old Tomnoddy can't spy me!
Attercop! Attercop!
Down you drop!
You'll never catch me up your tree!
http://shit.slashdot.org/article.pl?sid=04/11/09/1 350205
Weird. I'm Offtopic but you're funny. Must have been in the delivery.
What has happened to robertgraham.com ?? I used to send people there to get a clue about security. "Connection refused" ??!! Huh?
PenGun karma bad. From actually being a Cynical old Fart
... Standards and Practices !
PenGun
Do What Now ???
Check out: ettercap.darwinports.com
http://tinyurl.com/4ny52
I think ettercap really caters to kiddies, like AimSniff.pl and others, especially with all the password tools. It is for switched lans, which is like the popular Linksys routers, so many a thirteen year old adolescent is using ettercap to read someones AIM conversations.
[So] I didn't know it existed, but this tool sounds relly useful to me as a completely "white" application.
I work at a company that makes cell phone system test gear. We help cell phone companies set up quality and throughput testing and transport/content correctness.
Many is the time when, as I develop the tidbits, I want to see the data flow and content actually being received. I have become a zen grand master of getting my ass lost piecing together partial frames and retransmits.
A program that reconstructs the session streams into "content" for me would be amazingly useful.
Not so much as an "admin" tool, and more as a development aid, this thing sounds well worth investigating.
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press
In case you didn't catch this, its a quote of the song Bilbo sang when taunting the spiders of Mirkwood in "The Hobbit"
(Horrors. I almost wrongly said it was a misquote of a Tom Bombadil song from The Fellowship of the Ring.. Shudder, what a public embarasment THAT would have been...)
Its not users who are broken, it's systems not taking account their likely behaviour and fixing it technically.
"Stay with me, until the end of time...and you'll quickly see that moderators are seldom kind"
"Look Lois, the two symbols of the Republican Party: an elephant, and a fat white guy who is threatened by change."
Blaming people for their own actions! You're sounding like a damn republican....there's no place for that on slashdot :)
Those who know, do not speak. Those who speak, do not know. ~Lao Tzu