Ettercap For Mac

Ettercap is a lightweight yet powerful command line application mainly designed for computer network protocol analysis and security auditing.

Ettercap is designed to test if various hosts on a local network are susceptible to man-in-the-middle attacks, as well as to see if you can sniff live connections, filter traffic content, to actively or passively dissect various protocols and more.

With Ettercap’s help, you’ll be able to intercept traffic on a given network segment, capture passwords and actively conduct active man-in-the-middle attacks against a number of common protocols.

Ettercap is capable to successfully put a network interface into promiscuous mode and it can also send fake Address Resolution Protocol messages to the targeted machines via the Local Area Network.

In other words, Ettercap acts as a “man in the middle” which can deploy various attacks on its targets.  On top of that, Ettercap comes with plugin support, a fact that allows you to expand its feature list by adding new plugins.

Moreover, Ettercap helps you inject data in an established connection, filter the data on the fly and also offers you numerous features for network and host analysis.

As mentioned above, Ettercap supports active and passive dissection of protocols and provides four different operation modes. In the IP-based mode, the packets are filtered based on IP source and destination, the MAC-based mode filters the packets based on MAC address and, as a result you can sniff connection through a getway.

The ARP-based mode uses ARP poisoning in order to sniff on a switched LAN between two hosts and the PublicARP-based mode uses the same technique to sniff on a switched LAN from a targeted hosts to all other hosts.

It is worth mentioning that you are required to have Apple XCode installed on your Mac since you need to built Ettercap from source. You can find detailed instructions on how to build and install Ettercap on your Mac in the included INSTALL file.