Introduction to the hping Command

hping is an open-source command-line network tool for generating and parsing TCP/IP protocol packet assembly and analysis. The latest version is hping3, which supports TCP/UDP/ICMP and RAW-IP protocols, features traceroute mode, can send files between covered channels, and offers many other capabilities.

hping3 is commonly used for TCP ping, security testing, port scanning, firewall testing, and other tasks. The advantage of hping lies in its ability to customize various parts of packets, enabling flexible and detailed probing of target machines.

Installing hping3

# Ubuntu/Debian
apt-get install -y hping3
# CentOS/RHEL
yum install -y hping3

hping3 Parameter List

  -h  --help      Show help
  -v  --version   Show version
  -c  --count     Limit the number of packets to send
  -i  --interval  Packet sending interval (uX for X microseconds, e.g., -i u1000)
      --fast      Equivalent to -i u10000 (10 packets/sec)
      --faster    Equivalent to -i u1000 (100 packets/sec)
      --flood     Send packets at maximum host performance
  -n  --numeric   Numeric output, no DNS resolution
  -q  --quiet     Quiet mode (no output during process)
  -I  --interface Specify network interface (e.g., eth0)
  -V  --verbose   Verbose mode
  -D  --debug     Debug information
  -z  --bind      TTL of outgoing packets, bind ctrl+z shortcut (default bound, press once to increase TTL by 1, press twice to decrease by 1)
  -Z  --unbind    Unbind ctrl+z shortcut
      --beep      Beep for each matching packet received
# Mode selection (default mode is TCP)
  -0  --rawip      RAW IP mode, hping sends IP headers with data
  -1  --icmp       ICMP mode
  -2  --udp        UDP mode
  -8  --scan       SCAN mode (e.g., hping --scan 1-30,70-90 -S www.target.host)
  -9  --listen     Listen mode
# IP mode parameters
  -a  --spoof      Spoof source IP
  --rand-dest      Random destination address (e.g., hping3 -I eth0 --rand-dest 192.168.1.x, x represents 0-255)
  --rand-source    Use random address to spoof your own address
  -t  --ttl        Specify TTL value (default: 64)
  -N  --id         ID value in hping (default: random)
  -W  --winid      Use WINDOWS id byte order (UNIX/WINDOWS responses differ)
  -r  --rel        Relative id field, output with decreasing ID
  -f  --frag       Fragment packets after transmission, can pass through weak ACLs (Access Control Lists)
  -x  --morefrag   Set more fragments flag
  -y  --dontfrag   Set don't fragment flag
  -g  --fragoff    Set fragment offset
  -m  --mtu        Set virtual MTU, when packet > MTU, use --frag for fragmentation
  -o  --tos        Specify Type of Service (default: 0x00), use --tos help for help
  -G  --rroute     Record IP route and display route buffer
  --lsrr           Loose source routing
  --ssrr           Strict source routing
  -H  --ipproto    Set IP protocol, only used in RAW IP mode
# ICMP mode parameters
  -C  --icmptype   Specify ICMP type (default: echo request)
  -K  --icmpcode   Specify ICMP code (default: 0)
      --force-icmp Force ICMP type (default: only send supported types)
      --icmp-gw    ICMP redirect (default: 0.0.0.0)
      --icmp-ts    ICMP timestamp, equivalent to --icmp --icmptype 13
      --icmp-addr  ICMP subnet address, equivalent to --icmp --icmptype 17
      --icmp-help  ICMP help
# UDP/TCP mode parameters
  -s  --baseport   Source port (default: random)
  -p  --destport   Set destination port (default: 0)
  -k  --keep       Keep source port
  -w  --win        Set window size (default: 64)
  -O  --tcpoff     Set fake TCP data offset (replaces TCP address length divided by 4)
  -Q  --seqnum     Display only TCP sequence number
  -b  --badcksum   Attempt to send packets with bad IP checksum. Many systems will fix the IP checksum of sent packets, resulting in incorrect UDP/TCP checksums
  -M  --setseq     Set TCP sequence number
  -L  --setack     Set TCP acknowledgment number
  -F  --fin        Set FIN flag
  -S  --syn        Set SYN flag
  -R  --rst        Set RST flag
  -P  --push       Set PUSH flag
  -A  --ack        Set ACK flag
  -U  --urg        Set URG flag
  -X  --xmas       Set X unused flag (0x40)
  -Y  --ymas       Set Y unused flag (0x80)
  --tcpexitcode    Use last tcp->th_flags as exit code
  --tcp-mss        Enable TCP MSS option with given value
  --tcp-timestamp  Enable TCP timestamp option to guess HZ/uptime
# Common parameters
  -d  --data       Packet size to send (default: 0)
  -E  --file       File data
  -e  --sign       Add 'signature'
  -j  --dump       Dump packet in hexadecimal
  -J  --print      Dump printable characters
  -B  --safe       Enable 'safe' protocol
  -u  --end        When using --file option, prompt at EOF and prevent rewind
  -T  --traceroute Traceroute mode (includes --bind and --ttl 1)
  --tr-stop        In traceroute mode, exit when first non-ICMP packet is received
  --tr-keep-ttl    Keep source TTL fixed, useful for monitoring single hops
  --tr-no-rtt      Don't calculate/display RTT information in traceroute mode
# ARS packet description (new, unstable)
  --apd-send       Send packets described by APD (see docs/APD.txt)

Common hping3 Commands

• TCP ping
  hping3 -S -p 80 <IP address> - TCP ping to port 80
• Port scanning
  hping3 -S --scan 21-500 <IP address> - Scan ports 21-500