I don't ask for help often, so here goes...

I've been testing out 'non-standard' usage of Ettercap with an application idea I have, but have run into a brick wall with something regarding Etterfilters:

How does one specify a _range_ or IP addresses in an Etterfilter for ip.src?

As per the documentation:

"An ip address MUST be enclosed within two single quotes (eg. ’’)."

  • My filter works fine with a single IP
  • It doesn't compile when a range is specified in single quotes (such as '' or '')
  • The filter does compile when using double quotes (such as "" and ""), but the filter doesn't actually hit on the IP ranges specified.

Very basic testing code for the filter:

if (ip.dst == '' && ip.src == "") {
   msg("Test Succeeded \n");
The only other idea I have would be to use 256 || operators for the range I'm actually trying to filter, such as

(ip.dst == '' && ip.src == '' || ip.src == '' || ip.src == '' ...etc
So there either has to be a correct syntax, or it just doesn't support ranges for the ip.src parameter... can anyone chime on on this?