Usage: ettercap [OPTION] [HOST:PORT] [HOST:PORT] [MAC] [MAC]

Sniffing method:
  -a, --arpsniff               ARPBASED sniffing (specifying two hosts)
                               SMARTARP (specifying one host but with the list)
                               PUBLICARP (specifying only one host silently)
                               in silent mode : must specify both IP and MAC
                                 i.e.: ettercap -Nza IP IP MAC MAC    (ARPBASED)
                                       ettercap -Na IP MAC           (SMARTARP)
                                       ettercap -Nza IP MAC          (PUBLICARP)
  -s, --sniff                  IPBASED sniffing
                               you can specify the ANY ip that means ALL hosts
                                 e.g.: ettercap -Nzs ANY:80  (sniff only http)
  -m, --macsniff               MACBASED sniffing 
                                 e.g.: ettercap -zm MAC1 MAC2
                                       ettercap -Nm MAC

Off Line Sniffing:
  -T, --readpcapfile           OFFLINE sniffing (read packets from a file)
                                 e.g.: ettercap -T file_dumped_from_tcpdump
  -Y, --writepcapfile          DUMP packets to a pcap compatible file format
                                 e.g.: ettercap -NzsY file_to_be_dumped

General options:
  -N, --simple                 NON-interactive mode (without ncurses)
  -z, --silent                 silent mode (no arp storm on start up)
  -O, --passive                passive scanning of the LAN
  -b, --broadping              broadcast ping instead of arp storm on start up
  -D, --delay <n sec>          the delay between arp replies when poisoning (default is 30 sec)
  -Z, --stormdelay <n usec>    the delay between arp requests on startup (def is 1500 usec)
  -B, --bufferlen <n pck>      the lenght of each connection buffer. 
                               0 for no connection buffer (def is 3)
  -r, --refresh <n sec>        clear internal lists after n sec (def is 300)
  -S, --spoof <IP>             on start up send requests with this IP
  -H, --hosts <IP1[;IP2][;..]> on start up scan only these hosts
  -d, --dontresolve            don't resolve the IPs (speed up the startup)
  -i, --iface <iface>          network interface to be used
  -n, --netmask <netmask>      the netmask used to scan the lan
  -e, --etterconf <filename>   load options from a config file
  -j, --loadhosts <filename>   load host/mac list from a file
  -k, --savehosts              save host/mac list to a file
  -X, --forceip                disable the spoofed ICMP before poisoning
  -v, --version                check for the latest ettercap version
  -y, --yes                    in combination with -v auto answer yes
  -h, --help                   this help screen

Silent mode options (combined with -N):
  -t, --proto <proto>          sniff only <proto> connection (def. is tcp+udp)
                               proto can be: tcp, udp or all
  -J, --onlypoison             don't sniff, only do arp poisoning
  -R, --reverse                sniff all the connection but the selected one
  -p, --plugin <name>          run the "name" plugin ("list" for available ones)
  -l, --list                   list all hosts in the lan
  -C, --collect                collect users and passwords only
                               this options must be used with a sniffing method
                                    Eg: ettercap -NCzs
  -f, --fingerprint <host>     do active OS fingerprinting on HOST
  -1, --hexview                display data in hex mode
  -2, --textview               display data in text mode
  -3, --ebcdicview             display data in ebcdic mode
  -L, --logtofile              logs all data to specific file(s)
                               (for pcap use -Y)
  -q, --quiet                  "demonize" ettercap (useful with -L)
  -w, --newcert                create a new SSL cert file for HTTPS dissector
  -F, --filter <filename>      load  "filename" as the filter chain file
  -c, --check                  check for other poisoners on the LAN
  -g, --linktype               tries to indentify the LAN type (switch or hub)