Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am messing around with Ettercap and performing some MITM on my own home network.

I have Ettercap performing the MITM fine. I have my iPhone on the network and it autoadds the iPhone. I then run urlsnarf to view the websites I am visiting and that works perfectly also. However. The machine I am performing the MITM attack from appears in the urlsnarf logs. Does anyone know of a way to exclude the machine that I am running the MITM from being picked up by Ettercap?

Here is the command I am running to start Ettercap:

sudo ettercap -T -P autoadd -Q -M ARP -i eth0 /192.168.0.1/ /192.168.0.2-100/

Thanks

share|improve this question

migrated from security.stackexchange.com Jul 31 '13 at 4:26

This question came from our site for Information security professionals.

1 Answer 1

There's no specific 'exclude' option I know of for Ettercap that will explicitly exclude a target from view, while still allowing you to only include that 192.168.0.2-100 range you have.

However, you can reverse the target specification using the -R switch, and get basically the same result, though you give up the ability to fine tune your target. Basically, Ettercap allows you to only exclude OR include, not both.

Look under TARGET SPECIFICATION in the Ettercap docs at http://www.irongeek.com/i.php?page=backtrack-3-man/ettercap for more info.

Also, you also can use the parameters of urlsnarf to only collect data from a specific host using a tcpdump(8) filter too. http://www.irongeek.com/i.php?page=backtrack-3-man/urlsnarf

And honestly, did you try just using an IP address on your monitoring computer that is out of range of the target spec? You are using /192.168.0.2-100/, assigning your IP to 192.168.0.101 would keep it from being MITM'ed by Ettercap. This seems to be the most obvious way, so I'm wondering why bother with a post.

Remember that depending on a host of factors, the use of these tools will be either perfectly legal, or totally illegal. Ignorance of the law is no defense. DunDunDun

share|improve this answer
    
THanks for this. Will look into some of these options. I am aware of the legalities of this but it is all on my home network just for fun. –  user28891 Oct 17 '13 at 14:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.