I know of the two programs, one is Wireshark (a packet sniffing program) and the other is Ettercap (a man in the middle attack program). I tried doing a MITM attack before, legally on my own home network, with both the programs Wireshark and Ettercap and the result was same: I got the same username and passwords with both programs. If I have Wireshark, do I still need Ettercap to do a MITM attack, or since the result is the same can I do it with just Wireshark?


2 Answers 2


Wireshark is a passive packet analyzer which allows you to look at network traffic and search it.

Ettercap can do that too, but it is also able to actively change any network traffic routed through it. You can set it up to drop, modify or insert certain network packets.


With wireshark you can only monitor traffic that goes in and out of your own computer (or wherever wireshark is running on). With ettercap you can monitor traffic going in and out on another machine.

  • This is not accurate. Wireshark can monitor traffic that isn't destined to or sourced by the device it is on. You need a network card that permits the collection of those packets, but that's not difficult. ettercap actually can only deal with traffic to the machine. You can perform tricks to get other traffic to the machine, though. But you have not explained that.
    – schroeder
    Mar 2, 2023 at 17:38
  • Small nitpick: you could do MitM as well... Mar 2, 2023 at 18:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .