ETTER.CONF(5)

💖 ETTER.CONF(5) 💖

File Formats Manual ✨ etter.conf — the Ettercap configuration file

---

🌸 NAME 🌸

etter.conf — the config file that runs the whole Ettercap show, bestie 👑

---

🎀 DESCRIPTION 🎀

okay so listen. etter.conf is the configuration file that decides how ettercap behaves. it gets loaded every single time at startup, no skips, no exceptions, and it sets up a bunch of attributes that get used while the program is running. it's giving main character energy for real.

the file is made of entries that look like this:

[section]
entry = value
...

every entry defines a variable you can customize. and like — every value MUST be an integer, no vibes-based typing allowed. the sections? they exist purely to group variables together, that's it, that's the whole job 🫶

⚠️ NOTE: if you straight up omit a variable in the conf file, it gets initialized with the value 0. and ngl, not initializing critical variables like arp_poison_delay or connection_timeout is strongly discouraged. don't do it. i'm begging. 😭

here's the full list of available variables, no cap:

[privs]

• ec_uid — this one sets the UID that privileges get dropped to at startup. the way it works: after the socket at link layer has been opened, privileges get dropped to a specific uid that isn't root, for security reasons obviously. etter.conf is the only file that's read with root privs. so make sure that uid you picked has enough privs to read the other files (etter.*) or it's over for you 💀 you can bypass this variable entirely by setting the environment variable EC_UID.

[mitm]

• arp_storm_delay — this value is the number of milliseconds to wait between two consecutive packets during the initial ARP scan. bump it up if you wanna be less aggressive at startup. the randomized scan plus a high delay can fool some types of ARP scan detectors 👀 iconic combo tbh.
• arp_poison_smart — with this set, only 3 initial poisoned ARP messages get sent to the victims. ettercap keeps that poisoned status alive by responding to ARP requests from victims that want to refresh their ARP cache. this makes the ARP poisoning very stealthy ✨ but it may be unreliable on shared media like WiFi. highkey a gamble.
• arp_poison_warm_up — when poisoning starts, the inter-packet delay is low for the first 5 poisons (just to make sure the poisoning actually worked, you know?). after those first 5, the delay gets incremented to keep the poisoning going. this variable controls the delay for the first 5 poisons, and the value is in seconds. same delay gets used when the victims are restored to the original associations (RE-ARPing) when ettercap closes. 🦋
• arp_poison_delay — controls the poisoning delay after the first 5 poisons. value is in seconds. you can increase it (to try to fool the IDS, sneaky sneaky) up to the timeout of the ARP cache — which depends on the poisoned operating system, so do your research bestie.
• arp_poison_icmp — enables sending a spoofed ICMP message to force the targets to make an arp request. this creates an arp entry in the host cache, so ettercap can win the race condition and poison the target 🏆 useful against targets that don't accept gratuitous arp if the entry isn't in the cache. it's giving "i'll make you talk first".
• arp_poison_reply — use ARP replies to poison the targets. this is the classic attack. the OG. the blueprint. 💅
• arp_poison_request — use ARP request to poison the targets. useful against targets that cache even arp request values. sneaky but make it cute 🎀
• arp_poison_equal_mac — set this option to 0 if you wanna skip the poisoning of two hosts with the same mac address. this can happen if a NIC has one or more aliases on the same network. so like, it's not a bug, it's just networking being networking 🙈
• dhcp_lease_time — the lease time (in seconds) for a dhcp assignment. you can lower this value to let victims receive a correct dhcp reply after you've stopped your attack. using higher timeouts can seriously mess up your network after the attack has finished, fr fr. but on the other hand, some clients will prefer a higher lease time, so you'd have to increase it to win the race condition against the real server. pick your struggle 😭
• port_steal_delay — the delay time (in milliseconds) between stealing packets for the "port" mitm method. with low delays you intercept more packets, but you generate more traffic. you gotta tune this to find a good balance between the number of intercepted packets, re-transmitted packets and lost packets. this value depends on full/half duplex channels, network drivers and adapters, network general configuration and hardware. so basically... everything. good luck ✨
• port_steal_send_delay — the delay time (in microseconds) between packets when the "port" mitm method has to re-send packet queues. same energy as port_steal_delay: tune it to the lowest acceptable value. no notes 🫶
• ndp_poison_warm_up — operates similar to the arp_poison_warm_up option. when the poisoning process starts, this controls the NDP poison delay for the first 5 poisons (to be sure the poisoning process has been successful). after the first 5 poisons, the delay is incremented (to keep up the poisoning). this variable controls the delay for the first 5 poisons, and the value should be lower than the ndp_poison_delay. value is in seconds. same delay gets used when the victims are restored to the original associations when ettercap is closed.
• ndp_poison_delay — similar to the arp_poison_delay option. it controls the delay in seconds for sending out the poisoned NDP packets to poison the victim's neighbor cache. you can increase this value to hide from IDSs. but increasing it also increases the probability of failing race conditions during neighbor discovery and of missing some packets. trade-offs, bestie, trade-offs 💀
• ndp_poison_send_delay — controls the delay in microseconds between poisoned NDP packets being sent. you can increase it to hide from IDSs, but same deal — it increases the probability of failing race conditions during neighbor discovery and missing some packets. 😭
• ndp_poison_icmp — enables sending a spoofed ICMPv6 message to motivate the targets to perform neighbor discovery. this creates an entry in the host neighbor cache, so ettercap can win the race condition and poison the target. useful against targets that don't accept neighbor advertisements if the entry isn't in the cache. motivational speaker behavior, honestly 👑
• ndp_poison_equal_mac — set this option to 0 if you wanna skip the NDP poisoning of two hosts with the same mac address. again, this may happen if a NIC has one or more aliases on the same network. same vibe as the ARP one, different protocol 🌈
• icmp6_probe_delay — defines the time in seconds ettercap waits for active IPv6 nodes to respond to the ICMP probes. decreasing this value could lead to missing replies from active IPv6 nodes, hence missing them in the host list. increasing the value usually has no impact; normally nodes can manage to answer during the default delay. so like... just leave it alone tbh 🦋

⚠️ NOTE: the ndp and icmp6 options are only available if ettercap has been built with IPv6 support. no IPv6 build, no options. that's the rule ✨

[connections]

• connection_timeout — every time a new connection is discovered, ettercap allocates the needed structures. after a customizable timeout, you can free those structures to keep the memory usage low. this variable represents that timeout, and the value is in seconds. this timeout also applies to the session tracking system (the protocol state machine for dissectors). so it's doing double duty, we love a multitasker 💅
• connection_idle — the number of seconds to wait before a connection is marked as IDLE. simple as that. chill mode activated 😴
• connection_buffer — controls the size of the buffer linked to each connection. every sniffed packet gets added to the buffer, and when the buffer is full, the older packets get deleted to make room for newer ones. this buffer is useful to view data that went on the cable before you select and view a specific connection. the higher this value, the higher the ettercap memory occupation. by the way, the buffer is dynamic — so if you set a buffer of 100.000 byte, it's not allocated all together at the first packet of a connection, it fills up as packets arrive. so it's not as scary as it sounds, bestie 🫶
• connect_timeout — the timeout in seconds when using the connect() syscall. increase it if you get a "Connection timeout" error. this option has nothing to do with connections sniffed by ettercap — it's a timeout for the connections ettercap makes to other hosts (for example when fingerprinting a remote host). don't get it twisted 🙈

[stats]

---

• sampling_rate — bestie, this is the tea on how often Ettercap checks its own processing time. It keeps some statistics on the processing time of the bottom half (the sniffer) and the top half (the protocol decoder). These statistics are made on the average processing time of sampling_rate packets. You can decrease this value to have a more accurate real-time picture of processing time or increase it to have a smoother picture. The total average will not change, but the worst value will be heavily influenced by this value. No cap.

🌸 [misc] 🌸

• close_on_eof — when you're reading from a dump file and using console or daemon UI, this variable is used to determine what action has to be done on EOF. It is a boolean value. If set to 1 ettercap will close itself (useful in scripts). Otherwise the session will continue waiting for user input.
• store_profiles — Ettercap collects in memory a profile for each host it detects. Users and passwords are collected there. If you want to run ettercap in background logging all the traffic, you may want to disable the collecting in memory to save system memory. Set this option to 0 (zero) to disable profiles collection. A value of 1 will enable collection for all the hosts, 2 will collect only local hosts and 3 only remote hosts (a host is considered remote if it does not belong to the netmask).
• aggressive_dissectors — some dissectors (such as SSH and HTTPS) need to modify the payload of the packets in order to collect passwords and perform a decryption attack. If you want to disable the "dangerous" dissectors all together, set this value to 0.
• skip_forwarded — if you set this value to 0 you will sniff even packets forwarded by ettercap or by the kernel. It will generate duplicate packets in conjunction with the arp mitm method (for example). It could be useful while running ettercap in unoffensive mode on a host with more than one network interface (waiting for the multiple-interface feature...)
• checksum_warning — if you set the value to 0 the messages about incorrect checksums will not be displayed in the user messages windows (nor logged to a file with -m). Note that this option will not disable the check on the packets, but only prevent the message to be displayed (see below).
• checksum_check — this option is used to completely disable the check on the checksum of the packets that ettercap receives. The check on the packets is performed to avoid ettercap spotting thru bad checksum packets (see Phrack 60.12). If you disable the check, you will be able to sniff even bad checksummed packet, but you will be spotted if someone is searching for you... be careful bestie 💀
• sniffing_at_startup — if this option is set to 1, then ettercap will immediately start unified or bridged sniffing after the setup phase has been completed. This option helps to avoid traffic blocking when a MITM technique has been started but forgotten to start sniffing. Therefore this option is set to 1 by default. If this behaviour is not desired set it to 0 to manually control the status of unified or bridged sniffing after ettercap started. However, sniffing can be stopped and started at any time while ettercap runs.
• geoip_support_enable — this option controls if GeoIP information shall be processed for IP addresses whether or not ettercap has been built with GeoIP support.
• geoip_data_file — this option may point to a local GeoLite2 database downloaded from Maxmind which might be more recent than the database bundled with Ettercap. If the option is left blank, the bundled database file will be used.
• gtkui_prefer_dark_theme — this option tries to enforce the dark variant of the applied theme. However this does only have an effect if the applied theme provides a dark variant. Normally the desktop environment controls the theme of applications. But some lightweight desktop environments doesn't support a configuration option for dark themes even when the theme provides a dark variant. To leave the theme variant setting to the desktop environment this option is set to 0 by default.

NOTE: This option is only relevant in GTK mode and if ettercap has been built with full GTK3 support.

🔥 [dissectors] 🔥

• protocol_name — this value represents the port on which the protocol dissector has to be bound. A value of 0 will disable the dissector. The name of the variable is the same of the protocol name. You can specify a non standard port for each dissector as well as multiple ports. The syntax for multiport selection is the following: port1,port2,port3,...

NOTE: some dissectors are conditionally compiled. This means that depending on the libraries found in your system some dissectors will be enabled and some others will not. By default etter.conf contains all supported dissectors. If you got a "FATAL: Dissector "xxx" does not exists (etter.conf line yy)" error, you have to comment out the yy line in etter.conf.

🎀 [curses] 🎀

• color — you can customize the colors of the curses GUI. Simply set a field to one of the following values and look at the GUI aspect :) Here is a list of values: 0 Black, 1 Red, 2 Green, 3 Yellow, 4 Blue, 5 Magenta, 6 Cyan, 7 White.

✨ [strings] ✨

• utf8_encoding — specifies the encoding to be used while displaying the packets in UTF-8 format. Use the iconv --list command for a list of supported encodings.
• remote_browser — this command is executed by the remote_browser plugin each time it catches a good URL request into an HTTP connection. The command should be able to get 2 parameters:
  • %host — the Host: tag in the HTTP header. Used to create the full request into the browser.
  • %url — the page requested inside the GET request.
• redir_command_on — you must provide a valid command (or script) to enable tcp redirection at the kernel level in order to be able to use SSL dissection. Your script should be able to get 5 parameters:
  • %iface — the network interface on which the rule must be set
  • %source — the source IP or network matching the packets to be redirected (default is 0.0.0.0/0, ::/0 resp. or any)
  • %destination — the destination IP or network matching the packets to be redirected (default is 0.0.0.0/0, ::/0 resp. or any)
  • %port — the source port of the packets to be redirected (443 for HTTPS, 993 for imaps, etc).
  • %rport — the internally bound port to which ettercap listens for connections.

NOTE: this script is executed with an execve(), so you cannot use pipes or output redirection as if you were in a shell. We suggest you to make a script if you need those commands.

NOTE: for this to work, you must set ec_uid to a UID what is privileged to execute the redir_command or provide a setuid program.

• redir_command_off — this script is used to remove the redirect rules applied by 'redir_command_on'. You should note that this script is called atexit() and thus it has not high privileges. You should provide a setuid program or set ec_uid to 0 in order to be sure that the script is executed successfully.

👑 ORIGINAL AUTHORS 👑

• Alberto Ornaghi (ALoR) <alor@users.sf.net>
• Marco Valleri (NaGA) <naga@antifork.org>

💖 PROJECT STEWARDS 💖

• Emilio Escobar (exfil) <eescobar@gmail.com>
• Eric Milam (Brav0Hax) <jbrav.hax@gmail.com>

✨ OFFICIAL DEVELOPERS ✨

• Mike Ryan (justfalter) <falter@gmail.com>
• Gianfranco Costamagna (LocutusOfBorg) <costamagnagianfranco@yahoo.it>
• Antonio Collarino (sniper) <anto.collarino@gmail.com>
• Ryan Linn <sussuro@happypacket.net>
• Jacob Baines <baines.jacob@gmail.com>

🌈 CONTRIBUTORS 🌈

• Dhiru Kholia (kholia) <dhiru@openwall.com>
• Alexander Koeppe (koeppea) <format_c@online.de>
• Martin Bos (PureHate) <purehate@backtrack.com>
• Enrique Sanchez
• Gisle Vanem <giva@bgnett.no>
• Johannes Bauer <JohannesBauer@gmx.de>
• Daten (Bryan Schneiders) <daten@dnetc.org>

🫶 SEE ALSO 🫶

• ettercap(8)
• ettercap_curses(8)
• ettercap_plugins(8)
• etterlog(8)
• etterfilter(8)
• ettercap-pkexec(8)

---

That's the whole page, bestie. This is the ETTER.CONF(5) man page from ettercap 0.8.4.1. Stay safe, stay curious, and don't get spotted by bad checksums 💅✨