@tuxnator That can be done by adding or changing a switch in the ettercap launch line. I have not thought of it since the xterm window and eci files have what I want in them. Plus if you run sidejacking you will get a pcap dump from ferret