Ettercap is a network utility tool used for ARP spoofing, packet filtering, traffic interception, passive scanning, and DHCP hijacking. It functions as a network traffic interceptor and man-in-the-middle packet filter to monitor and manipulate live TCP/UDP connections on a local area network.
The project provides specialized capabilities for traffic redirection via ARP cache poisoning, DHCP server spoofing, ICMP redirects, and switch port stealing. It also enables the emulation of rogue services and the decryption of SSH1 session streams by substituting public keys.
Additional capabilities include network discovery through active host discovery and passive LAN scanning, as well as network topology mapping. The tool supports real-time traffic manipulation by injecting forged data into live streams and filtering network payloads using custom scripts.