I don't ask for help often, so here goes...

I've been testing out 'non-standard' usage of Ettercap with an application idea I have, but have run into a brick wall with something regarding Etterfilters:

How does one specify a _range_ or IP addresses in an Etterfilter for ip.src?

As per the documentation:

"An ip address MUST be enclosed within two single quotes (eg. ’192.168.0.7’)."

  • My filter works fine with a single IP
  • It doesn't compile when a range is specified in single quotes (such as '1.1.1.0-255' or '1.1.1.0-1.1.1.255')
  • The filter does compile when using double quotes (such as "1.1.1.0-5" and "1.1.1.0-1.1.1.255"), but the filter doesn't actually hit on the IP ranges specified.


Very basic testing code for the filter:

Code:
if (ip.dst == '2.2.2.2' && ip.src == "1.1.1.0-255") {
   msg("Test Succeeded \n");
}
The only other idea I have would be to use 256 || operators for the range I'm actually trying to filter, such as

Code:
(ip.dst == '2.2.2.2' && ip.src == '1.1.1.1' || ip.src == '1.1.1.2' || ip.src == '1.1.1.3' ...etc
So there either has to be a correct syntax, or it just doesn't support ranges for the ip.src parameter... can anyone chime on on this?

Thanks