len''46 ip''192.168.1.1 flags''RA DF seq''0 ttl''255 id''0 win''0 rtt''0.4 ms tos''0 iplen''40 seq''0 ack''1380893504 sum''2010 urp''0
$ _-D --debug_: Enable debug mode, it's useful when you experience some problem with hping3. When debug mode is enabled you will get more information about**interface detection, data link layer access, interface settings, options parsing, fragmentation, HCMP protocol** and other stuff. $ _-z --bind_: Bind CTRL+Z to**time to live (TTL)** so you will able to increment/decrement ttl of outgoing packets pressing CTRL+Z once or twice. $ _-Z --unbind_: Unbind CTRL+Z so you will able to stop hping3. $ _--beep//Beep for every matching received packet (but not for ICMP errors).
: ==== Protocol Selection ==== Default protocol is TCP, by default hping3 will send tcp headers to target host's port 0 with a winsize of 64 without any tcp flag on. Often this is the best way to do an 'hide ping', useful when target is behind a firewall that drop ICMP. Moreover a tcp null-flag to port 0 has a good probability of not being logged. $ _-0 --rawip_: RAW IP mode, in this mode hping3 will send IP header with data appended with --signature and/or --file, see also --ipproto that allows you to set the ip protocol field. $ _-1 --icmp_: ICMP mode, by default hping3 will send ICMP echo-request, you can set other ICMP type/code using**--icmptype --icmpcode** options. $ _-2 --udp_: UDP mode, by default hping3 will send udp to target host's port 0. UDP header tunable options are the following:**--baseport, --destport, --keep.** $ _-8 --scan_: Scan mode, the option expects an argument that describes groups of ports to scan. port groups are comma separated: a number describes just a single port, so 1,2,3 means port 1, 2 and 3. ranges are specified using a start-end notation, like 1-1000, that tell hping to scan ports between 1 and 1000 (included). the special word**all** is an alias for 0-65535, while the special word**known** includes all the ports listed in /etc/services.**#hping3 win98 --seqnum -p 139 -S -i u1 -I eth0**
HPING uaz (eth0 192.168.4.41): S set, 40 headers + 0 data bytes 2361294848 +2361294848 2411626496 +50331648 2545844224 +134217728 2713616384 +167772160 2881388544 +167772160 3049160704 +167772160 3216932864 +167772160 3384705024 +167772160 3552477184 +167772160 3720249344 +167772160 3888021504 +167772160 4055793664 +167772160 4223565824 +167772160 The first column reports the sequence number, the second difference between current and last sequence number. As you can see target host's sequence numbers are predictable.
$ _-b --badcksum_: Send packets with a bad UDP/TCP checksum.
$ _--tcp-timestamp_: Enable the TCP timestamp option, and try to guess the timestamp update frequency and the remote system uptime.
$ _-F --fin_: Set FIN tcp flag.
$ _-S --syn_: Set SYN tcp flag.
$ _-R --rst_: Set RST tcp flag.
$ _-P --push_: Set PUSH tcp flag.
$ _-A --ack_: Set ACK tcp flag.
$ _-U --urg_: Set URG tcp flag.
$ _-X --xmas_: Set Xmas tcp flag.
$ _-Y --ymas_: Set Ymas tcp flag.
==== Common Options ====
//-d --data data size//Set packet body size. Warning, using --data 40 hping3 will not generate 0 byte packets but protocol_header+40 bytes. hping3 will display packet size information as first line output, like this:**HPING www.yahoo.com (ppp0 204.71.200.67): NO FLAGS are set, 40 headers + 40 data bytes**
$ _-E --file filename_: Use**filename** contents to fill packet's data.
$ _-e --sign signature_: Fill first _signature length//bytes of data with _signature_. If the _signature length//is bigger than data size an error message will be displayed. If you don't specify the data size hping will use the signature size as data size. This option can be used safely with _--file filename//option, remainder data space will be filled using _filename_.
$ _-j --dump_: Dump received packets in hex.
$ _-J --print_: Dump received packets' printable characters.
$ _-B --safe_: Enable safe protocol, using this option lost packets in file transfers will be resent. For example in order to send file /etc/passwd from host A to host B you may use the following: [host_a] **# hping3 host_b --udp -p 53 -d 100 --sign signature --safe --file /etc/passwd** _[host_b]//**# hping3 host_a --listen signature --safe --icmp**
$ _-u --end_: If you are using _--file filename//option, tell you when EOF has been reached. Moreover prevent that other end accept more packets. Please, for more information see the**HPING3-HOWTO**.
$ _-T --traceroute_: Traceroute mode. Using this option hping3 will increase ttl for each**ICMP time to live 0 during transit** received. Try**hping3 host --traceroute**. This option implies --bind and --ttl 1. You can override the ttl of 1 using the --ttl option. Since 2.0.0 stable it prints RTT information.
$ _--tr-keep-ttl_: Keep the TTL fixed in traceroute mode, so you can monitor just one hop in the route. For example, to monitor how the 5th hop changes or how its RTT changes you can try**hping3 host --traceroute --ttl 5 --tr-keep-ttl**.
$ _--tr-stop_: If this option is specified hping will exit once the first packet that isn't an ICMP time exceeded is received. This better emulates the traceroute behavior.
$ _--tr-no-rtt_: Don't show RTT information in traceroute mode. The ICMP time exceeded RTT information aren't even calculated if this option is set.
$ _--tcpexitcode_: Exit with last received packet tcp->th_flag as exit code. Useful for scripts that need, for example, to known if the port 999 of some host reply with SYN/ACK or with RST in response to SYN, i.e. the service is up or down.
==== Tcp Output Format ====
The standard TCP output format is the following:
len''46 ip''192.168.1.1 flags''RA DF seq''0 ttl''255 id''0 win''0 rtt''0.4 ms
**len** is the size, in bytes, of the data captured from the data link layer excluding the data link header size. This may not match the IP datagram size due to low level transport layer padding.
**ip** is the source ip address.
**flags** are the TCP flags, R for RESET, S for SYN, A for ACK, F for FIN, P for PUSH, U for URGENT, X for not standard 0x40, Y for not standard 0x80.
If the reply contains**DF** the IP header has the don't fragment bit set.
**seq** is the sequence number of the packet, obtained using the source port for TCP/UDP packets, the sequence field for ICMP packets.
**id** is the IP ID field.
**win** is the TCP window size.
**rtt** is the round trip time in milliseconds.
If you run hping using the**-V** command line switch it will display additional information about the packet, example:
len''46 ip''192.168.1.1 flags''RA DF seq''0 ttl''255 id''0 win''0 rtt''0.4 ms tos''0 iplen''40 seq''0 ack''1223672061 sum''e61d urp''0
**tos** is the type of service field of the IP header.
**iplen** is the IP total len field.
**seq and ack** are the sequence and acknowledge 32bit numbers in the TCP header.
**sum** is the TCP header checksum value.
**urp** is the TCP urgent pointer value.
==== Udp Output Format ====
The standard output format is:
len''46 ip''192.168.1.1 seq''0 ttl''64 id''0 rtt''6.0 ms
The field meaning is just the same as the TCP output meaning of the same fields.
==== Icmp Output Format ====
An example of ICMP output is:
ICMP Port Unreachable from ip''192.168.1.1 name''nano.marmoc.net
It is very simple to understand. It starts with the string "ICMP" followed by the description of the ICMP error, Port Unreachable in the example. The ip field is the IP source address of the IP datagram containing the ICMP error, the name field is just the numerical address resolved to a name (a dns PTR request) or UNKNOWN if the resolution failed.
The ICMP Time exceeded during transit or reassembly format is a bit different:
TTL 0 during transit from ip''192.168.1.1 name''nano.marmoc.net
TTL 0 during reassembly from ip''192.70.106.25 name''UNKNOWN
The only difference is the description of the error, it starts with TTL 0.
==== Author ====
Salvatore Sanfilippo < [[mailto:antirez@invece.org|antirez@invece.org]]>, with the help of the people mentioned in AUTHORS file and at http://www.hping.org/authors.html
==== Bugs ====
Even using the --end and --safe options to transfer files the final packet will be padded with 0x00 bytes.
Data is read without care about alignment, but alignment is enforced in the data structures. This will not be a problem under i386 but, while usually the TCP/IP headers are naturally aligned, may create problems with different processors and bogus packets if there is some unaligned access around the code (hopefully none).
On solaris hping does not work on the loopback interface. This seems a solaris problem, as stated in the tcpdump-workers mailing list, so the libpcap can't do nothing to handle it properly.
===== Examples =====
Often considered a complementary tool to Nmap, hping is used for network scanning, as well as crafting TCP/IP packets. Please note that given the packet crafting involved, if you are running as root yet you receive an error saying that the operation is not permitted it could be due to a host firewall.
Send TCP SYN packets to port 0 on host example.com (note that hping will increment the source port by 1 for each packet sent):
**hping example.com -S -V**
Send TCP SYN packets to port 443 on host example.com:
**hping example.com -S -V -p 443**
Send TCP packets to port 443 on host example.com with the SYN + ACK flags set:
**hping example.com -S -A -V -p 443**
Send TCP packets to port 443 on host example.com with the SYN + ACK + FIN flags set:
**hping example.com -S -A -F -V -p 443**
Send TCP SYN packets every 5 seconds to port 443 on host example.com:
**hping example.com -S -V -p 443 -i 5**
Send TCP SYN packets every 100,000 microseconds (i.e. every 0.1 second or 10 per second) to port 443 on host example.com. Note that verbose has been removed:
**hping example.com -S -p 443 -i u100000**
Send TCP SYN packets every 10,000 microseconds (i.e. every 0.01 second or 100 per second) to port 443 on host example.com:
**hping example.com -S -p 443 -i u10000**
Send TCP SYN packets every 10,000 microseconds (i.e. every 0.01 second or 100 per second) to port 443 on host example.com. Stop after 500 packets:
**hping example.com -S -p 443 -i u10000 -c 500**
Send UDP packets to port 111 on host example.com (argument --udp can be substituted with -2):
**hping example.com --udp -V -p 111**
Send ICMP echo request packets to host example.com (argument --icmp can be substituted with -1):
**hping example.com --icmp -V**
Send ICMP timestamp request packets to host example.com:
**hping example.com --icmp --icmp-ts -V**
Portscan TCP ports 100 to 110 on host example.com (argument --scan can be substituted with -8)
**hping example.com -V --scan 100-110**
Send UDP packets spoofed to be from source host 192.168.1.150 to host example.com
**hping example.com --udp --spoof 192.168.1.150**
Send UDP packets spoofed to be from various random source IP addresses to host example.com
**hping example.com --udp --rand-source**
Send UDP packets with the data portion padded with 100 bytes to host example.com
**hping example.com -V --udp --data 100**
Send UDP packets with the data portion padded with 100 bytes but containing the contents of payload.txt to host example.com (the payload will be truncated if it is smaller than what is specified by the --data argument)
**hping example.com -V --udp --file payload.txt --data 100**
===== More Examples =====
Example 1. (SYN Packet)
hping3 127.0.0.1 -c 1 -p 80 -S -c 1 – count aka number of packets to send -p 80 – destination port number -S – turn on the SYN flag in the packetExample 2. (ACK Packet)
hping3 127.0.0.1 -c 1 -p 80 -AExample 3. (RST Packet)
hping3 127.0.0.1 -c 1 -p 80 -RExample 4. (FIN Packet)
hping3 127.0.0.1 -c 1 -p 80 -FExample 5. (PUSH Packet)
hping3 127.0.0.1 -c 1 -p 80 -PExample 6. (URG Packet)
hping3 127.0.0.1 -c 1 -p 80 -UExample 7. (ICMP Echo)
hping3 127.0.0.1 -c 1 -1 -CExample 8. (ICMP TimeStamp)
hping3 127.0.0.1 -c 1 -1 -K 13Example 9. (All ICMP Types)
hping3 127.0.0.1 -c 1 -1 –force-icmpExample 10. (Resolve host to ip)
At your shell type hping3 then hit enter. It should look like the following: hping3> Now type: hping resolve www.compuhowto.com and it will resolve the host to its ip address.===== How to test the rules of your firewall by example using hping3 ===== In this how to I will be showing you a few ways you can test your firewall to see what is allowed and what is not. I will be testing the rules of a WRT54G v2 router with the newest Linksys firmware. These tests will be from the WAN since testing from the LAN would not be practical to someone trying to get through the perimeter. The process in which we want to take is to first determine if something is actually at the ip address, second can we determine what is at the other end, and finally are there any open ports. Let us start by simply sending a icmp echo command and see if we get a reply.
hping3 -c 1 -V -I eth0 -1 208.81.226.42
-c '' count
-V '' verbose
-I '' Network Interface to use
-1 '' ICMP packet
root@Ububox:/# hping3 -c 1 -V -I eth0 -1 208.81.226.42No reply! Good so the router is not responding to pings from the WAN. So how do we even know if anything is actually at that ip address? What if we tried to do a half-open SYN connection to the http port (80). Since most routers have an admin login (sometimes allowing remote login from the web). Issue the following command:
using eth0, addr: 192.168.2.108, MTU: 1500
HPING 208.81.226.42 (eth0 208.81.226.42): icmp mode set, 28 headers + 0 data bytes — 208.81.226.42 hping statistic —
1 packets transmitted, 0 packets received, 100% packet loss
round-trip min/avg/max '' 0.0/0.0/0.0 ms
hping3 -c 1 -V -I eth0 -s 8765 -p 80 -S 208.81.226.42 -s '' source port -p '' destination port -S '' set the SYN flag in the packet
root@Ububox:/# hping3 -c 1 -V -I eth0 -s 8765 -p 80 -S 208.81.226.42 using eth0, addr: 192.168.2.108, MTU: 1500 HPING 208.81.226.42 (eth0 208.81.226.42): S set, 40 headers + 0 data bytesFrom the result we still get no reply. Now lets try a little test of no flags which is called a null scan and we will see later that hping3 has an option built in for it. If it works and something is there we should get a RST packet back. Type the following hping3 command:
— 208.81.226.42 hping statistic — 1 packets transmitted, 0 packets received, 100% packet loss round-trip min/avg/max '' 0.0/0.0/0.0 ms
hping3 -c 1 -V -I eth0 -s 8765 -p 80 208.81.226.42 root@Ububox:/# hping3 -c 1 -V -I eth0 -s 8765 -p 80 208.81.226.42Success! We got a RST+ACK packet sent back to us. So now we know for sure something is at the ip-address, but was this a fluke? Will the same result happen to a port that might not exist (port 3486). Lets run the same test using a different non existing (hopefully) port. So change the “-p 80″ to “-p 3486″ and lets see what happens.
using eth0, addr: 192.168.2.108, MTU: 1500
HPING 208.81.226.42 (eth0 208.81.226.42): NO FLAGS are set, 40 headers + 0 data bytes
len''46 ip''208.81.226.42 ttl''127 id''0 tos''0 iplen''40
sport''80 flags''RA seq''0 win''0 rtt''1.0 ms
seq''0 ack''1069346811 sum''fb6c urp''0 — 208.81.226.42 hping statistic —
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max '' 1.0/1.0/1.0 ms
hping3 -c 1 -V -I eth0 -s 8765 -p 3486 208.81.226.42Same result we get a RST+ACK back again. So now what? We have made sure that some kind of equipment is there and it does respond. Lets move on to another kind of test we will come back to the port testing later. Lets see what happens when we do a icmp timestamp request (icmp type 13).
hping3 -c 1 -V -I eth0 -1 -C 13 208.81.226.42 -1 '' icmp packet -C 13 '' icmp type 13 (timestamp)
root@Ububox:/# hping3 -c 1 -V -I eth0 -1 -C 13 208.81.226.42No luck there. If it would of succeeded you would seen the exact time set on the remote host. Most routers/firewalls these days will not respond to these but at this point we do not know the type of equipment sitting at the other end so you never know so at least give it a try. Next will try the icmp address subnet mask test. What we hope will happen is this. We send the packet the remote end replies back with the subnet mask for the local network. (the more we know is better)
using eth0, addr: 192.168.2.108, MTU: 1500
HPING 208.81.226.42 (eth0 208.81.226.42): icmp mode set, 28 headers + 0 data bytes — 208.81.226.42 hping statistic —
1 packets transmitted, 0 packets received, 100% packet loss
round-trip min/avg/max '' 0.0/0.0/0.0 ms
hping3 -c 1 -V -I eth0 -1 -C 17 208.81.226.42 -C 17 '' icmp address mask root@Ububox:/# hping3 -c 1 -V -I eth0 -1 -C 17 208.81.226.42No response from this either. I was not expecting this to work, but again you don’t know till your try. Now lets return to the port testing procedures and lets try testing using the different types of flags being set in the packet. The first one we will try is the FIN flag. In a TCP connection the FIN flag is used to start the connection closing routine.
using eth0, addr: 192.168.2.108, MTU: 1500
HPING 208.81.226.42 (eth0 208.81.226.42): icmp mode set, 28 headers + 0 data bytes — 208.81.226.42 hping statistic —
1 packets transmitted, 0 packets received, 100% packet loss
round-trip min/avg/max '' 0.0/0.0/0.0 ms
hping3 -c 1 -V -I eth0 -s 8765 -p 53 -F 208.81.226.42 -F '' set FIN flag root@Ububox:~# hping3 -c 1 -V -I eth0 -s 8765 -p 53 -F 208.81.226.42We received a RST+ACK back. What we are wanting to see with this scan is not a reply back from the ip if we do not receive a reply then that port will be open. If you firewall rules are working correctly though it should send a RST+ACK back even if the port is open. So now lets move on to the next flag to set. This next one will be using the ACK flag. Using the ACK flag in a probe will help us determine if a host is at the ip we are probing. If the host is not responding to pings from the outside then you can use the ACK flag to probe a port that is most likely open (aka 80,8080).
using eth0, addr: 192.168.2.108, MTU: 1500
HPING 208.81.226.42 (eth0 208.81.226.42): F set, 40 headers + 0 data bytes
len''46 ip''208.81.226.42 ttl''127 id''0 tos''0 iplen''40
sport''53 flags''RA seq''0 win''0 rtt''0.9 ms
seq''0 ack''1790142628 sum''76c9 urp''0 — 208.81.226.42 hping statistic —
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max '' 0.9/0.9/0.9 ms
hping3 -c 1 -V -I eth0 -s 8765 -p 80 -A 208.81.226.42 -A '' Set ack flag root@Ububox:~# hping3 -c 1 -V -I eth0 -s 8765 -p 80 -A 208.81.226.42We are looking for a RST packet to be sent back from the host. In this example we did receive a packet back and so we know that there is something at that ip. Next scan to be used is known as the XMAS scan. What this does is set the seqence number to zero and set the URG + PSH + FIN flags in the packet.
using eth0, addr: 192.168.2.108, MTU: 1500
HPING 208.81.226.42 (eth0 208.81.226.42): A set, 40 headers + 0 data bytes
len''46 ip''208.81.226.42 ttl''127 id''0 tos''0 iplen''40
sport''80 flags''RA seq''0 win''0 rtt''0.9 ms
seq''559274943 ack''2094401506 sum''e61a urp''0 — 208.81.226.42 hping statistic —
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max '' 0.9/0.9/0.9 ms
hping3 -c 1 -V -I eth0 -s 8765 -p 8080 -M 0 -UPF 208.81.226.42 -M 0 '' set sequence number to zero -U '' set URG flag -P '' set PUSH flag -F '' set FIN flag root@Ububox:~# hping3 -c 1 -V -I eth0 -s 8765 -p 8080 -M 0 -UPF 208.81.226.42If the target device’s TCP port is closed, the target device sends a TCP RST packet in reply. If the target device’s TCP port is open, the target discards the TCP XMAS scan, sending no reply. Only if the firewall rules have not been configured to block this type of scan. The next and final example of this how to will show you the NULL scan. What this scan does is set the sequence number to zero and have no flags set in the packet.
using eth0, addr: 192.168.2.108, MTU: 1500
HPING 208.81.226.42 (eth0 208.81.226.42): FPU set, 40 headers + 0 data bytes
len''46 ip''208.81.226.42 ttl''127 id''0 tos''0 iplen''40
sport''8080 flags''RA seq''0 win''0 rtt''0.8 ms
seq''0 ack''1 sum''727d urp''0 — 208.81.226.42 hping statistic —
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max '' 0.8/0.8/0.8 ms
hping3 -c 1 -V -I eth0 -s 8765 -p 8080 -Y 208.81.226.42 -Y '' Null scan root@Ububox:~# hping3 -c 1 -V -I eth0 -s 8765 -p 8080 -Y 208.81.226.42If the target device’s TCP port is closed, the target device sends a TCP RST packet in reply. If the target device’s TCP port is open, the target discards the TCP NULL scan, sending no reply. ===== References ===== * [[http://www.hping.org/]] * [[http://rationallyparanoid.com/articles/hping.html|http://rationallyparanoid.com/articles/hping.html]] * [[http://linuxpoison.blogspot.com/2008/10/tools-for-creating-tcpip-packets.html|http://linuxpoison.blogspot.com/2008/10/tools-for-creating-tcpip-packets.html]] * [[http://ismellpackets.com/category/hping/|http://ismellpackets.com/category/hping/]] * [[http://www.compuhowto.com/security/hping3-mini-examples/]] * [[http://www.compuhowto.com/linux/hping3-examples/]] -- Main.FredPettis - 2012-05-29
using eth0, addr: 192.168.2.108, MTU: 1500
HPING 208.81.226.42 (eth0 208.81.226.42): Y set, 40 headers + 0 data bytes
len''46 ip''208.81.226.42 ttl''127 id''0 tos''0 iplen''40
sport''8080 flags''RA seq''0 win''0 rtt''1.2 ms
seq''0 ack''1350561991 sum''2c3c urp''0 — 208.81.226.42 hping statistic —
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max '' 1.2/1.2/1.2 ms