1

I am trying to do a sniffing attack and I want to save a .pcap file with the result of the analysis. I use this command:

bettercap --interface eth0 -X --proxy --sniffer-output /root/Escritorio/file.pcap

But when I open the file, it's empty.

Why it is this happening? How can I solve it?

korrigan
  • 400
  • 2
  • 12
Iratzar Carrasson Bores
  • 196
  • 1
  • 13

2 Answers2

1

Is it possible that your ethernet port isn't yielding anything? Try it with another interface e.g. wlan0 to see if that yields anything.

A suggestion: I think you're using the legacy version of bettercap. There's a new version (https://www.bettercap.org/) that takes less space, is more reliable, and faster - according to the website. If you got bettercap by typing "apt-get", that's going to download the old version.

Amy Jian
  • 51
  • 1
  • 3
0

With latest version of bettercap run the following to log to a file with -no-colors e.g.:

bettercap -no-colors -eval "events.stream off; set events.stream.output ~/bettercap-events.log; events.stream on"

Or one can just run the eval commands in the console if it's already running. According to this issue post one needs to restart the events.stream to get logging to a file to work.

user30473
  • 231
  • 2
  • 5