Ettercap supports active and passive dissection of many protocols (even encrypted ones) and includes many feature for network and host analysis.

data injection in an established connection and filtering (substitute or drop a packet) on the fly is also possible, keeping the connection synchronized.

many sniffing modes are implemented, for a powerful and complete sniffing suite. it is possible to sniff in four modes: ip based, mac based, arp based (full-duplex) and publicarp based (half-duplex).

ettercap also has the ability to detect a switched lan, and to use os fingerprints (active or passive) to find the geometry of the lan.

this package contains the common support files, configuration files, plugins, and documentation. you must also install either ettercap-graphical or ettercap-text-only for the actual gui-enabled or text-only ettercap executable, respectively.