Ettercap, atleast the linux version, has a plugin for that. I havent tried it yet, havent found the environment for it... Also, for the password sniffing, i prefer to use a tool like dsniff that i can control easier, and if it goes to shite, doesnt kill the lan till the next arp request reply tournament.
QUOTE
Remote traffic sniffing through tunnels and route mangling: You can play with
linux cooked interfaces or use the integrated plugin to sniff tunneled or route-
mangled remote connections and perform mitm attacks on them.
CODE
[0] gre_relay 1.0 Tunnel broker for redirected GRE tunnels
QUOTE
gre_relay
This plugin can be used to sniff GRE-redirected remote traffic. The basic
idea is to create a GRE tunnel that sends all the traffic on a router
interface to the ettercap machine. The plugin will send back the GRE pack-
ets to the router, after ettercap "manipulation" (you can use "active"
plugins such as smb_down, ssh decryption, filters, etc... on redirected
traffic) It needs a "fake" host where the traffic has to be redirected to
(to avoid kernel's responses). The "fake" IP will be the tunnel endpoint.
Gre_relay plugin will impersonate the "fake" host. To find an unused IP
address for the "fake" host you can use find_ip plugin. Based on the
original Tunnelx technique by Anthony C. Zboralski published in
http://www.phrack.org/show.php?p=56&a=10 by HERT.
<- Check that link, quiet a good how-to, was of interest to me...
