Bettercap Essentials

Bettercap is a modular network reconnaissance and security-auditing framework — a single Go binary that discovers hosts, maps a network, sniffs traffic, probes Wi-Fi and Bluetooth Low Energy, and can demonstrate man-in-the-middle conditions for testing. It's the modern successor to tools like Ettercap, used by penetration testers and network defenders to understand and harden the networks they own. This guide covers installation across platforms and the core workflow for safe, authorized network discovery.

Bettercap is organized into modules you turn on and off inside a session, and caplets — small script files that chain commands together to automate a workflow. Understanding this split is most of the learning curve.

The fastest routes. On security distributions, bettercap is already packaged; elsewhere, grab the precompiled binary from GitHub releases.

Prefer a container, or want the bleeding-edge build? Both are supported. The container needs host networking and elevated privileges to touch real interfaces — the same caveat as any packet tool in Docker.

Bettercap needs root (raw sockets) and a target interface. Launch it on the interface attached to your test network; with no caplet it drops you into the interactive prompt.

The bread-and-butter of authorized auditing: find out what's actually on your network. net.probe sends discovery packets, net.recon keeps the host list updated, and net.show prints the table.

Within seconds you'll see a table of every device that answered — IP, MAC address, hardware vendor (derived from the MAC), and activity. This alone is a useful inventory: spotting an unexpected device on your own LAN is a classic defensive win.

If the command line isn't your thing, bettercap ships a browser dashboard. It's delivered as a caplet that starts an API and serves the UI. Update the UI assets once, then launch it.

By default this serves the interface on http://127.0.0.1 with a username and password defined in the caplet. Open it in a browser on the same machine and you get point-and-click access to the host list, events, and module controls.

Typing the same module sequence every session gets old. A caplet is a plain-text file of session commands that runs top to bottom — your reusable playbook. List the bundled ones, then write your own.

Bettercap's wireless modules need a compatible adapter. Wi-Fi recon requires a card that supports monitor mode; BLE needs a Bluetooth Low Energy controller. These are discovery features — mapping what's broadcasting around you, which on your own devices is legitimate auditing.