Install ettercap with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman

Project links

• Homepage
• Repository
• Upstream docs
• Package manager page

Commands and aliases

• ettercap
• ettercap-pkexec
• etterfilter
• etterlog

Project history

Ettercap dates to the early 2000s; the current GitHub README identifies the project copyright as 2001-current by the Ettercap development team. Early package descriptions framed it as a multipurpose sniffer, interceptor, and logger for switched LANs, a niche that mattered when Ethernet switching made simple hub-style packet sniffing less effective.

The Ettercap-NG generation in the mid-2000s broadened the tool with a modernized interface, plugins, multiple simultaneous MITM attacks, and a more structured core. The official download history shows NG releases in 2004 and 2005, the Lazarus line in 2011 and 2012, the 0.8 series beginning in 2013, and later Garofalo releases continuing maintenance into 2026.

Adoption history

Ettercap became a standard security-lab and penetration-testing package because it combined active and passive protocol dissection with practical MITM mechanisms such as ARP poisoning, bridged sniffing, filtering, and connection logging. Its package metadata across Unix-like systems reflects that role: it is distributed in Homebrew, Debian and Ubuntu, Fedora, Arch, Alpine, MacPorts, Nix, and other security-oriented environments.

The project has remained recognizable because it occupies the space between packet analyzers and attack simulators. Users can capture and analyze traffic like a sniffer, but can also alter or redirect traffic in ways useful for authorized testing of LAN trust assumptions.

How it is used

The main `ettercap` program is used in text, curses, or graphical modes to discover hosts, select targets, run MITM modules, sniff traffic, and apply filters. Companion commands such as `etterfilter` and `etterlog` support compiling packet filters and inspecting saved logs.

The manual documents practical workflows such as ARP poisoning, bridge-mode interception with two interfaces, pcap-filtered capture, offline analysis from pcap files, and writing captured packets for later inspection with tools such as tcpdump or Wireshark.

Why package nerds care

Ettercap is package-nerd significant because it is a classic security tool whose build and runtime surface spans libpcap, libnet, OpenSSL, plugin support, terminal UI, optional GTK UI, GeoIP/MaxMind data, and privileged network access. Packaging it correctly means preserving both the text-mode toolchain and the surrounding data/config layout.

It also shows why security packages age differently from ordinary CLIs: release history is full of protocol-support updates, build fixes, memory-safety fixes, and CVE-related maintenance, while the core LAN-testing workflow remains recognizable decades after the first releases.

Timeline

• 2001: Ettercap project lineage begins, according to the current project README copyright range.
• 2004: Ettercap-NG 0.7.2 release appears in the official download history.
• 2005: Ettercap-NG 0.7.3 release adds filter-engine operators and plugin/security fixes.
• 2013: Ettercap 0.8.0 begins the 0.8 release series.
• 2020: Ettercap 0.8.3.1 ships further TLS, build, and runtime fixes.
• 2026: Ettercap 0.8.4.1-Garofalo fixes a heap out-of-bounds read in etterfilter.

Related projects

• Wireshark and tcpdump are commonly adjacent analysis tools; Ettercap can write captured packets for later use in packet analyzers.
• Ettercap's own companion tools include etterfilter for filters and etterlog for log inspection.

Sources

• https://www.ettercap-project.org/
• https://www.ettercap-project.org/downloads.html
• https://github.com/Ettercap/ettercap
• https://github.com/Ettercap/ettercap/blob/master/man/ettercap.8.in