Results 1 to 3 of 3

Thread: Ettercap ecp file to pcap format?

  1. #1
    Junior Member
    Join Date
    Feb 2010
    Posts
    31

    Default Ettercap ecp file to pcap format?

    I have a set of ettercap captures called test.ecp and test.eci. I can use etterlog to export to text or hex or whatever. I don't see an option to convert to pcap format so it can be read with wireshark.

    I would like to know if there is a tool to convert this?

    Alternatively, is there a tool / filter to pull SMB hashes from these files? Decoding the hex by hand is incredibly irritating. I must be doing it wrong.

  2. #2
    Member macphail's Avatar
    Join Date
    Jun 2010
    Location
    East Coast, USA
    Posts
    164

    Default Re: Ettercap ecp file to pcap format?

    Manual Page - ettercap(8)

    -w, --write <FILE>
    WRITE packet to a pcap file
    This is useful if you have to use "active" sniffing (arp poison) on a switched LAN but you want to analyze the packets with tcpdump or ethereal. You can use this option to dump the packets to a file and then load it into your favourite application.
    i know, i know. it says tcpdump or ethereal. however (as i'm sure you already know) wireshark will import a tcpdump .lpc all day long.

    good luck with that.
    -----------
    ~peace
    MacPhail

  3. #3
    Junior Member
    Join Date
    Feb 2010
    Posts
    31

    Default Re: Ettercap ecp file to pcap format?

    I appreciate that, but I'm looking to translate captures exported with the -L option. It was a brain fart, and can't be recaptured.
    Guess I'm going to have to roll my own...

Similar Threads

  1. Replay pcap file and use sslstrip
    By creepykrawler in forum Experts Forum
    Replies: 4
    Last Post: 03-27-2010, 04:22 AM
  2. Veritas exploit_MTF file format
    By humbleman in forum OLD Pentesting
    Replies: 5
    Last Post: 09-09-2009, 05:15 AM
  3. IVS and PCAP format cannot be used together
    By Takedown32 in forum OLD Latest Public Release - BackTrack4 Beta
    Replies: 9
    Last Post: 08-08-2009, 04:53 AM
  4. eapol-handshake capture file: wrong format
    By hagbard in forum OLD Newbie Area
    Replies: 0
    Last Post: 10-10-2008, 05:45 PM
  5. About the VMWare image format file
    By cr4ck3r in forum OLD BT3final Bugs and Fixes
    Replies: 0
    Last Post: 06-22-2008, 10:10 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •