# 使用 Homebrew, apk, dnf, MacPorts, Nix, pacman, apt 安装 ettercap

查看 ettercap 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

## 安装

```sh
sudo av install brew:ettercap
```

其他安装命令:

### macOS

- Homebrew (100%):

```sh
brew install ettercap
```

  证据: local Homebrew formula metadata

- MacPorts (94%):

```sh
sudo port install ettercap
```

  证据: MacPorts ports tree: net/ettercap/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

### Linux

- apk (92%):

```sh
sudo apk add ettercap
```

  证据: Alpine Linux edge package indexes: ettercap from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz

- dnf (92%):

```sh
sudo dnf install ettercap
```

  证据: Fedora Rawhide package metadata: ettercap from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst

- Nix (92%):

```sh
nix profile install nixpkgs#ettercap
```

  证据: nixpkgs package indexes: pkgs/by-name/et/ettercap/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

- pacman (92%):

```sh
sudo pacman -S ettercap
```

  证据: Arch Linux sync databases: ettercap from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

- Debian apt (92%):

```sh
sudo apt install ettercap-common
```

  证据: Debian stable package indexes: ettercap-common from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz

## 软件包事实

- **软件包键:** brew:ettercap
- **软件包管理器:** Homebrew
- **版本:** 0.8.4.1
- **来源摘要:** Multipurpose sniffer/interceptor/logger for switched LAN
- **主页:** <https://ettercap.github.io/ettercap/>
- **仓库:** <https://github.com/Ettercap/ettercap>
- **最后更新:** 2026-06-25T13:37:40+02:00
- **已生成:** 2026-08-03T19:37:03+00:00

## 可执行文件

- ettercap (别名)
- ettercap-pkexec (别名)
- etterfilter (别名)
- etterlog (别名)

## 安装行为

- Bottle: 不可用

## 版本和新鲜度

- 页面生成时间: 2026-08-03
- 管理器版本: 0.8.4.1
## 项目历史与用法

Ettercap is a long-running open-source network security suite for man-in-the-middle work on local networks. Its command-line package provides sniffing, interception, packet filtering, logging, protocol dissection, and host/network analysis tools for switched LAN environments.

### 项目历史

Ettercap dates to the early 2000s; the current GitHub README identifies the project copyright as 2001-current by the Ettercap development team. Early package descriptions framed it as a multipurpose sniffer, interceptor, and logger for switched LANs, a niche that mattered when Ethernet switching made simple hub-style packet sniffing less effective.

The Ettercap-NG generation in the mid-2000s broadened the tool with a modernized interface, plugins, multiple simultaneous MITM attacks, and a more structured core. The official download history shows NG releases in 2004 and 2005, the Lazarus line in 2011 and 2012, the 0.8 series beginning in 2013, and later Garofalo releases continuing maintenance into 2026.

### 采用历史

Ettercap became a standard security-lab and penetration-testing package because it combined active and passive protocol dissection with practical MITM mechanisms such as ARP poisoning, bridged sniffing, filtering, and connection logging. Its package metadata across Unix-like systems reflects that role: it is distributed in Homebrew, Debian and Ubuntu, Fedora, Arch, Alpine, MacPorts, Nix, and other security-oriented environments.

The project has remained recognizable because it occupies the space between packet analyzers and attack simulators. Users can capture and analyze traffic like a sniffer, but can also alter or redirect traffic in ways useful for authorized testing of LAN trust assumptions.

### 使用方式

The main `ettercap` program is used in text, curses, or graphical modes to discover hosts, select targets, run MITM modules, sniff traffic, and apply filters. Companion commands such as `etterfilter` and `etterlog` support compiling packet filters and inspecting saved logs.

The manual documents practical workflows such as ARP poisoning, bridge-mode interception with two interfaces, pcap-filtered capture, offline analysis from pcap files, and writing captured packets for later inspection with tools such as tcpdump or Wireshark.

### 为什么软件包爱好者会关心

Ettercap is package-nerd significant because it is a classic security tool whose build and runtime surface spans libpcap, libnet, OpenSSL, plugin support, terminal UI, optional GTK UI, GeoIP/MaxMind data, and privileged network access. Packaging it correctly means preserving both the text-mode toolchain and the surrounding data/config layout.

It also shows why security packages age differently from ordinary CLIs: release history is full of protocol-support updates, build fixes, memory-safety fixes, and CVE-related maintenance, while the core LAN-testing workflow remains recognizable decades after the first releases.

### 时间线

- 2001: Ettercap project lineage begins, according to the current project README copyright range.
- 2004: Ettercap-NG 0.7.2 release appears in the official download history.
- 2005: Ettercap-NG 0.7.3 release adds filter-engine operators and plugin/security fixes.
- 2013: Ettercap 0.8.0 begins the 0.8 release series.
- 2020: Ettercap 0.8.3.1 ships further TLS, build, and runtime fixes.
- 2026: Ettercap 0.8.4.1-Garofalo fixes a heap out-of-bounds read in etterfilter.

### Related projects

- Wireshark and tcpdump are commonly adjacent analysis tools; Ettercap can write captured packets for later use in packet analyzers.
- Ettercap's own companion tools include etterfilter for filters and etterlog for log inspection.

### 来源

- <https://www.ettercap-project.org/>
- <https://www.ettercap-project.org/downloads.html>
- <https://github.com/Ettercap/ettercap>
- <https://github.com/Ettercap/ettercap/blob/master/man/ettercap.8.in>


## 安全说明

escape, surveillance, or offensive capability signal.

- **Geiger 风险:** red / 中
- escape, surveillance, or offensive capability signal


## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: /etc/etter.conf
## 其他软件包管理器记录

- Debian apt - ettercap-common - 1:0.8.3.1-14: normalized package name match | Debian stable package indexes: ettercap-common from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Multipurpose sniffer/interceptor/logger for switched LAN | https://ettercap.github.io/ettercap/
- Debian apt - ettercap-graphical - 1:0.8.3.1-14: normalized package name match | Debian stable package indexes: ettercap-graphical from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Ettercap GUI-enabled executable | https://ettercap.github.io/ettercap/
- Debian apt - ettercap-text-only - 1:0.8.3.1-14: normalized package name match | Debian stable package indexes: ettercap-text-only from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Ettercap console-mode executable | https://ettercap.github.io/ettercap/
- Nix - ettercap: normalized package name match | nixpkgs package indexes: pkgs/by-name/et/ettercap/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- Ubuntu apt - ettercap-common - 1:0.8.3.1-13build3: normalized package name match | Ubuntu 24.04 LTS package indexes: ettercap-common from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Multipurpose sniffer/interceptor/logger for switched LAN | https://ettercap.github.io/ettercap/
- Ubuntu apt - ettercap-graphical - 1:0.8.3.1-13build3: normalized package name match | Ubuntu 24.04 LTS package indexes: ettercap-graphical from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Ettercap GUI-enabled executable | https://ettercap.github.io/ettercap/
- Ubuntu apt - ettercap-text-only - 1:0.8.3.1-13build3: normalized package name match | Ubuntu 24.04 LTS package indexes: ettercap-text-only from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Ettercap console-mode executable | https://ettercap.github.io/ettercap/
- apk - ettercap - 0.8.4.1-r0: normalized package name match | Alpine Linux edge package indexes: ettercap from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz | Multipurpose sniffer/interceptor/logger for switched LAN | https://www.ettercap-project.org/
- apk - ettercap-doc - 0.8.4.1-r0: normalized package name match | Alpine Linux edge package indexes: ettercap-doc from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz | Multipurpose sniffer/interceptor/logger for switched LAN (documentation) | https://www.ettercap-project.org/
- apk - libettercap - 0.8.4.1-r0: normalized package name match | Alpine Linux edge package indexes: libettercap from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz | Multipurpose sniffer/interceptor/logger for switched LAN (libraries) | https://www.ettercap-project.org/
- dnf - ettercap - 0.8.4.1-3.fc45: normalized package name match | Fedora Rawhide package metadata: ettercap from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Network traffic sniffer/analyser, NCURSES interface version | http://ettercap.sourceforge.net
- pacman - ettercap - 0.8.4.1-1: normalized package name match | Arch Linux sync databases: ettercap from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Network sniffer/interceptor/logger for ethernet LANs - console | https://www.ettercap-project.org/
- pacman - ettercap-gtk - 0.8.4.1-1: normalized package name match | Arch Linux sync databases: ettercap-gtk from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Network sniffer/interceptor/logger for ethernet LANs - GTK frontend | https://www.ettercap-project.org/
- MacPorts - ettercap: normalized package name match | MacPorts ports tree: net/ettercap/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1


## Combined YAML source

View the package source record on GitHub. [combined/ettercap.yml](https://github.com/mxcl/pkgdb/blob/main/combined/ettercap.yml)


## 来源

- pkg.so package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph