Ettercap
Ettercap is a free, open-source suite for man-in-the-middle testing and network analysis.
What Ettercap is
Ettercap is a free, open-source suite for man-in-the-middle testing and network analysis. It can sniff live connections, dissect protocols actively or passively, and examine network and host activity. Its passive LAN scanning can extract host, operating-system, port, and gateway information from observed traffic. The integrated filter engine supports packet-payload changes, with filters compiled using etterfilter. Ettercap offers command-line, graphical, and ncurses interfaces, plus PCAP support, remote capture, traffic decryption, and flow analysis. It runs on Linux and macOS and can be self-hosted. Listed tested systems include Debian/Ubuntu, Fedora, Gentoo, Pentoo, Mac OS X, FreeBSD, OpenBSD, and NetBSD. The downloads page lists version 0.8.4.1-Garofalo, released April 7, 2026, and publishes SHA256 checksums for bundled-library and source-only archives. That version fixes a heap-out-of-bounds read in etterfilter identified as CVE-2026-3606. Building from source requires tools and libraries including libpcap, libnet, pthread, zlib, CMake, Flex, and Bison. The project invites GitHub pull requests and bug reports through its tracker.
Good
- Free and open-source project.
- Offers command-line, graphical, and ncurses interfaces.
- Passive LAN scanning extracts host and gateway details.
- Latest listed release includes an etterfilter security fix.
- Downloads include SHA256 checksums.
Watch out
- No free trial is listed.
- Source builds require several libraries and tools.
- Windows versions are listed as unsupported.
- Runs on Linux and macOS.
Who it suits
Ettercap suits network testing and analysis work involving live traffic, protocol dissection, or host and network inspection. It is aimed at users comfortable with supported systems and, for source builds, the listed development dependencies.
Verdict
Ettercap provides several interfaces and traffic-analysis capabilities for network testing, with source available at no cost. Check its supported systems and build requirements before choosing it.
Plans and prices
From Ettercap's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Ettercap | Free | Open-source project · source code downloads |
The facts
Each one read from Ettercap's own pages, with the date it was checked.
What it does
- Build requirements
- Source compilation requires libraries and tools including libpcap, libnet, pthread, zlib, CMake, Flex, and Bison.checked 4 Oct 2026
- Filtering
- Its integrated filtering engine lets users write filters that can modify packet payloads; filters are compiled with etterfilter.checked 4 Oct 2026
- Interfaces
- The project offers command-line, graphical, and ncurses interfaces.checked 4 Oct 2026
- Network discovery
- Passive LAN scanning can extract host, operating-system, port, and gateway information from observed traffic.checked 4 Oct 2026
- Project and license
- The project describes itself as 100% open source and community run; its GitHub repository identifies the license as GPL-2.0.checked 4 Oct 2026
- Protocol analysis
- Ettercap supports active and passive dissection of many protocols.checked 4 Oct 2026
- Purpose
- Ettercap is a suite for man-in-the-middle testing with live connection sniffing, on-the-fly content filtering, protocol dissection, and network and host analysis.checked 4 Oct 2026
- Recent security fix
- Version 0.8.4.1 lists a fix for a heap-out-of-bounds read issue in etterfilter identified as CVE-2026-3606.checked 4 Oct 2026
- Release
- The downloads page lists version 0.8.4.1-Garofalo, released April 7, 2026, as the latest release.checked 4 Oct 2026
- Source integrity
- The downloads page publishes SHA256 checksums for both bundled-library and source-only archives of the latest release.checked 4 Oct 2026
- Support and contributions
- The project invites contributions through GitHub pull requests and directs bug reports to its GitHub bug tracker.checked 4 Oct 2026
- Supported systems
- The project lists Debian/Ubuntu, Fedora, Gentoo, Pentoo, Mac OS X, FreeBSD, OpenBSD, and NetBSD as tested distributions or systems.checked 4 Oct 2026
- Who it serves
- The project describes Ettercap as a MiTM tool and documents network and host analysis capabilities, indicating use in network testing and analysis.checked 4 Oct 2026
Where it runs
- Platform caveat
- The about page lists Windows Vista, Windows 7, Windows 8, and Windows 10 as unsupported distributions where installation may work with additional settings.checked 4 Oct 2026
Alternatives to Ettercap
- 1
NETCAP
Free planOpen sourceWebAPILinuxmacOS8.1From €49 a month - 2
A-Packets
Free planWebAPILinuxSelf-hosted7.5From $99 a year - 3
Wireshark
Free planOpen sourceAPILinuxmacOSSelf-hosted7.5Free plan - 4
Colasoft Capsa
Free planWindows7.4$295 one-time - 5
Arkime
Free planOpen sourceWebAPILinuxSelf-hosted7.3Free plan - 6
OpenGrep
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan