On the etterfilter(8) man page, there is a section about the inject() function, which takes the contents of a file and injects it in a packet, or as its own packet when coupled with drop():


this function injects the content of the file 'what' after the packet being processed. It always injects in DATA.data. You can use it to replace the entire packet with a fake one using the drop() function right before the inject() command. In that case the filtering engine will drop the current packet and inject the fake one.


However, there is no documentation anywhere I have looked to speak to what type of file is expected by this function. (Another user on a BackTrack Linux forum had the same question.)

What type of file does etterfilter's inject() function take? PCAP? Plain text? Another file format?

1 Answer 1


I raised Issue #576 on the ettercap GitHub repository for clarification. The official response is that ettercap will inject the raw contents of any file into a packet (or into its own packet, if used in conjunction with the drop() command).

It does not require any particular file format.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .