Hping3
Hping3
hping3 is a network tool able to send custom ICMP/UDP/TCP packets and to display target replies like ping does with ICMP replies. It handles fragmentation and arbitrary packet body and size, and can be used to transfer files under supported protocols. Using hping3, you can test firewall rules, perform (spoofed) port scanning, test network performance using different protocols, do path MTU discovery, perform traceroute-like actions under different protocols, fingerprint remote operating systems, audit TCP/IP stacks, etc. hping3 is scriptable using the Tcl language.
Basic Usage
The best way to learn how to use hping3 is to look at the help of the tool.
hping3 -h
That displays all the different options.
As you can see, you have plenty of different options for using hping3.
Basic ping usage with HPing3
In order to do a basic ping with hping3, you need to do (most of these hping3 commands require sudo permissions):
sudo hping3 192.168.8.142
Resulting in:
We can also limit the number of ping requests:
sudo hping3 192.168.8.142 -c 1
This simply send one ping.
We can also ping just a specific port number. For instance lets ping just port 80.
sudo hping3 -S 192.168.8.142 -p 80 -c 1
Hping3 Scanning
hping3 can be also used to perform several types of scanning on hosts. We can use it to check which are the ports and services status on a given target.
sudo hping3 --scan 21,22,80 -S 192.168.8.142
In this case we are trying to check the status of ports 21, 22 and 80.
We can also scan for given port ranges (10-1000):
sudo hping3 --scan 10-1000 -S 192.168.8.142
It is also possible to check the uptime of a given service:
sudo hping3 -p 80 -S 192.168.8.142 --tcp-timestamp
It is even possible to do a SYN flood on a victim. Beware of this since it may cause a DoS. If you are using virtual machines, they might hang.
sudo hping3 -p 80 -S 192.168.8.142 -a 192.168.8.254 --flood
(in this case, we are flooding 192.168.8.142 with SYN requests on port 80, and we are changing the return IP address (spoofing) to 192.168.8.254)
If we try to use a web browser to access 192.268.8.142 websites, it would be impossible.
Further references
Last updated