ettercap is bugging in Backtrack 5 R1 32bits and 64 bits versions fully updated
ettercap version: NG-0.7.3

In ettercap filter
if (ip.proto == TCP && tcp.src == 80) {
log(, "tmp/log.txt");
From the log file, I can see that doesn't contain the full TCP/UDP payload but only the TCP/UDP payload at index 434 (0x1b2).

The following picture shows an hexdump of log.txt file that displays the content of

The following picture shows ettercap http response within Wireshark

This bug is not present in Backtrack 4 R2