Slashdot Mirror
The men behind ettercap-NG
An anonymous reader writes "In 2001 two Italians released the first beta version of ettercap, a network protocol analyzer. Ettercap is now covered in most security books. It's number 9 in the Top 75 Security Tools list of the Nmap Hackers mailing list. This summer they released ettercap-NG, which was completely rewritten from scratch with better, modular code, making it easier to add new features and write and submit patches. NewsForge recently caught up with its authors for an Interview."
Thats one way to deal with windows people
Or the explanation of what it does? It's a security tool. That's all I know about it.
./-ers won't RTFA... what makes the submitter think we'll head on over to Google for more info?
Most
Ok, I'm off to Google to figure out what ettercap is.
Where is the link to ettercap?
Here it is!
My other account has a 3-digit UID.
I agree re: ethereal.
I don't know why it wasn't linked to in the article, but here you go:
Homepage: http://ettercap.sourceforge.net/
Description: A suite for man in the middle attacks and network mapping
All too often, software announcements mention just the name of the item and not what it is or why it's interesting. As an example, compare this recent summary for Zope.
Not everyone's heard of Ettercap; this summary says what it is (network protocol analyzer) and also why it's important (in top ten of security tools). I hope to see more summaries of this caliber on Slashdot.
You're comparing apples and oranges. Ettercap is not just a packet dumping/protocol analyzer tool like tcpdump. It has many active features, like arp-cache poisoning, data injection etc.
For the lasy one:
http://ettercap.sourceforge.net/
I agree with regards to tcpdump, its small and relatively good at its job. That said, I mostly use it to capture packets and dump them to a file for analysis with other programs (ntop, snort, and tcpdump itself)
Ethereal? Its nice if it wasn't ridden with bugs and security issues. More alternatives in this market are a good thing, especially when talking about gui based capture tools.
The other top tools.
ettercap has almost nothing to do with ethereal, tcpdump or any other general-purpose sniffers. It's for a men-in-the-middle attack, with ARP poisoning and other techniques, not for simply sniffing packets that already come to your NIC.
It can sniff in a switched enviroment. You can't do this whith TCPDUMP !!!
Ettercap is evil :)
It's more of a hacking tool than a network analizer. It allows you to sniff switched networks, perform man-in-the-middle-attacks, it looks for passwords, etc.
We chose the GPL because it's the most used, so it has to be the best.
I have a nice Windows XP CD to sell you, guys.
--
Glass, total pwnage.
err? If it can be broken into, why not do it yourself first and fix the problem instead of letting someone else do it?
I don't know why it wasn't linked to in your post, but here you go:
Homepage: http://ettercap.sourceforge.net/
"If a frog had side pockets, he'd carry a hand gun" - Dan Rather
Its man in the middle feature lets me catch botnets on my college campus (I work in the IT dept.) and shut them down immediately.
"...won't you stay a while"
"Look Lois, the two symbols of the Republican Party: an elephant, and a fat white guy who is threatened by change."
"anyone care to justify this application, which seems to be yet another blackhat/script kiddy tool?"
:)
Anyone who's smart enough to use it effectively deserves results
Seriously, a swiss army knife for kiddies is by definition a swiss army knife for security testers and system managers. I'd prefer for hacking tools to be available for all rather than just for the malicious portion of the online population.
For the love of God, please learn to spell "ridiculous"!!!
Actually you only need a poisoning tool for that matters, not that tcpdump have it, but is not that hard to acomplish actually
I'm positive, don't belive me look at my karma
Because I use linkification which frees me from having to worry about such mundalities.
/. comments when idiots like me forget to put the anchor tags in ;)
I find its main use is for reading
As a bit of a sidenote, does anyone know of a program like Windows' Sniffer that has a "dashboard" type of applet which display the current packets per second going through an interface, or any other pps monitor (text or graphical)?
The new 3.0 release of the excellent Ultimate Boot CD has Ettercap included with the INSERT live CD. If you're a Windows user, it's an easy way to boot into Linux and try it out without having to worry about compiling and what not.
What I should have said was nothing.
Can tcpdump take ownership of a connection you are sniffing (for example, take control of a telnet session between two hosts, anc close the connection to one of the two host while retaining the one with th other)?
ettercap can.
and have used it for long for time. I tend to use it for evil and not good though =/. Being on a switched enviroment at work makes it the perfect happy fun time tool! :-)
It is perfectly legal for me to do anything I like on my network. What more justification do I need?
Perhaps we should ban debuggers too, because all we can use them for is breaking into commercial software...
iptraf does this pretty well. You can have a look at screenshots of it in action here.
The program did something similar, it would monitor network traffic and show you all the images that were being transmitted. So you could run it and figure out what sites people were surfing and stuff like that. It was very cool, but I have been unable to find it recently and I don't remember the name. Can anyone help me? Any programs that do this? Thanks.
Comment forecast: Bits of genius surrounded by a sea of mediocrity.
I sniff traffic all the time using ethereal, etherpeek, and tcpdump. I do this to verify traffic from remote customers, help debug developers custom applications, and estimate bandwidth usage by application. I dont have a need for ettercap, man in the middle attacks, or arp poisoning though. Sniffers do have many legitimate uses other than spying on email and IM sessions.
You want gkrellm.
It's great. If you run Red Hat though, they removed it from EL3, because such a useful server monitoring program has no place in the enterprise. (I.E. They are fucking retarded).
You can use the packages for RH9 though.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
Its all in the user, net tools (i.e. ettercap) don't kill networks, people kill networks.
Don't be a Hem, find some new cheese.
You're being deliberately obtuse in your statement about protocol sniffers. How do you know what I do with a sniffer on my network?
Protocol sniffers do not invade peoples privacy, people do.
Sure, you just void your warrenty.
What about these DVDs and CDs I bought, I can rip them onto my laptop so I don't have to carry my CDs and DVDs around? I bought these too.
You can back them up, or convert them to some other format for your convinience.
So I can burn down my own house? I own it... ah... oh... well half of it, the bank owns the other bit (d'oh). If I select the half I own, say the bathroom and the box room; I can trash that with impunity.
You can do what you want with your house with in the limit of the law.
Ownership doesn't necessarily convey infinite rights, just demans good stewardship. Don't forget to tell Bush...
Ownership allows you to do what you want with your property as long as it is within the law. Nothing demands good stewardship, unless you count community peer pressure.
And I did tell Bush, I voted for him. :-)
Is ettercap uttercrap?
Soooo... your theory behind network intrusion testing is that you shouldn't try to break into the network while you're doing it, and therefore any tool that would help you do it must be useless or evil?
Remind me to never hire you for anything related to network security testing....
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
I think it was the terminal font that was ugly and not the program.
"The world only exists in your eyes. You can make it as big or as small as you want." - F Scott Fitzgerald
By "real" I mean you get paid to admin a box other than your own.
I'm just curious. I tend to avoid the "dark gray" tools like this and stick to the "light gray" tools like nmap.
So have you used this tool? In what capacity? Penetration testing? Just poking around the network? For your own education or did you use the info in a report or to solve a specific problem? Etc?
Just wondering if I should take the time to add it to my toolbox.
Old fat spider
spinning in a tree!
Old fat spider
can't see me!
Attercop! Attercop!
Won't you stop,
Stop your spinning
and look at me!
Old Tomnoddy, all big body,
Old Tomnoddy can't spy me!
Attercop! Attercop!
Down you drop!
You'll never catch me up your tree!
What has happened to robertgraham.com ?? I used to send people there to get a clue about security. "Connection refused" ??!! Huh?
Check out: ettercap.darwinports.com
http://tinyurl.com/4ny52
I think ettercap really caters to kiddies, like AimSniff.pl and others, especially with all the password tools. It is for switched lans, which is like the popular Linksys routers, so many a thirteen year old adolescent is using ettercap to read someones AIM conversations.
[So] I didn't know it existed, but this tool sounds relly useful to me as a completely "white" application.
I work at a company that makes cell phone system test gear. We help cell phone companies set up quality and throughput testing and transport/content correctness.
Many is the time when, as I develop the tidbits, I want to see the data flow and content actually being received. I have become a zen grand master of getting my ass lost piecing together partial frames and retransmits.
A program that reconstructs the session streams into "content" for me would be amazingly useful.
Not so much as an "admin" tool, and more as a development aid, this thing sounds well worth investigating.
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press
In case you didn't catch this, its a quote of the song Bilbo sang when taunting the spiders of Mirkwood in "The Hobbit"
(Horrors. I almost wrongly said it was a misquote of a Tom Bombadil song from The Fellowship of the Ring.. Shudder, what a public embarasment THAT would have been...)
Its not users who are broken, it's systems not taking account their likely behaviour and fixing it technically.
Ettercap running under Knoppix crashed, while sniffing the entire floor's network (my laptop was acting as the router for the floor, no wonder it crashed). Slight problem though, almost at once everyone looked up and went "did Exchange go down?". Had to rush from desk to desk flushing the arp table on people's system, as they were still trying to use the laptop as the default gateway.
Man watching 6 MSCE's around a sun box, looks alot like the opening scene's of 2001:space odyssey...
"Stay with me, until the end of time...and you'll quickly see that moderators are seldom kind"
"Look Lois, the two symbols of the Republican Party: an elephant, and a fat white guy who is threatened by change."
Blaming people for their own actions! You're sounding like a damn republican....there's no place for that on slashdot :)
Those who know, do not speak. Those who speak, do not know. ~Lao Tzu