I did a few tests running ettercap using always the same filter but on different bt version or different hardware.
The filter consist of replacing the "It" with "XX" on a freshly installed apache (a very simple page). I am using ARP poisoning. In all cases the ARP poisoing was working and I could see the traffic passing through my attackiing PC but:
On a Dell Latitude E5410
- using BT 5 32: I was able to replace the 'It'
- using BT 5 32 but with a USB Wifi: no replacement
- using BT 5 64 (with all updates asof today): no replacement
- Using vmware what ever BT 5 version: no replacement
This sounds to me as a defect in Ettercap 64 bit version but I do not explain why it does not work with an external USB card...