A Man in the Middle (MITM) attack is a cyber-attack in which an attacker secretly intercepts and possibly alters the communication between two parties who believe they are directly communicating with each other. In practical networking environments such as corporate LANs, cloud-connected offices, Wi-Fi hotspots, or even home networks, MITM attacks are often carried out through techniques like ARP spoofing, DNS spoofing, or session hijacking. One commonly used tool for demonstrating and performing MITM attacks in controlled lab environments is Ettercap. Ettercap is an open-source network security tool designed for network analysis and penetration testing. It supports active and passive dissection of protocols and includes features for sniffing, content filtering, and host analysis. In a practical setup, consider a local area network where multiple devices are connected through a switch or router. Normally, when a victim system communicates with a gateway (for example, to access a cloud service or web application), data packets travel directly between the victim and the router. However, in a MITM attack using Ettercap, the attacker places their system logically between these two devices without physically altering the network topology. This is commonly achieved through ARP poisoning. Address Resolution Protocol (ARP) is used in IPv4 networks to map IP addresses to MAC addresses. When a device wants to communicate with another device in the same network, it broadcasts an ARP request asking, “Who has this IP address?” The legitimate device replies with its MAC address. ARP, however, has no authentication mechanism, which makes it vulnerable to spoofing. In an ARP poisoning attack, the attacker sends forged ARP replies to both the victim and the gateway. The victim is tricked into believing that the attacker’s MAC address corresponds to the gateway’s IP address, and the gateway is tricked into believing that the attacker’s MAC address corresponds to the victim’s IP address. As a result, all traffic between the victim and the gateway flows through the attacker’s system. Ettercap automates this process. In a penetration testing lab, the attacker machine runs Ettercap and selects the network interface connected to the LAN. The attacker identifies target hosts either manually by specifying IP addresses or by scanning the network using Ettercap’s host discovery feature. Once the targets (victim and gateway) are selected, the attacker initiates ARP poisoning through Ettercap’s interface. Ettercap continuously sends spoofed ARP replies to maintain its