packetlevel.ch

hping

hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.

hping samples

Ping with hping

	hping 192.168.1.100		-> simple ping
	hping -1 -c 100 192.168.0.2 	-> send 100 (-c ) pings

Ping with data in the packet
first create a text file with the Textdata. Sample: "data in my ICMP packet" with the length of 22 characters

	echo "data in my ICMP packet" > data.txt

now send the packet.

	hping -d 22 -E data.txt -1 -c 100 192.168.2.200

and the tcpdump output is the following

sudo tcpdump -X -nn -s 0 -i eth0 icmp
18:29:30.930009 IP 192.168.2.100 > 192.168.2.200: ICMP echo request, id 27678, seq 2560, length 30
        0x0000:  4500 0032 75e4 0000 4001 7e6a c0a8 0264  E..2u...@.~j...d
        0x0010:  c0a8 02c8 0800 c023 6c1e 0a00 6461 7461  .......#l...data
        0x0020:  2069 6e20 6d79 2049 434d 5020 7061 636b  .in.my.ICMP.pack
        0x0030:  6574                                     et
18:29:30.930454 IP 192.168.2.200 > 192.168.2.100: ICMP echo reply, id 27678, seq 2560, length 30
        0x0000:  4500 0032 4f3c 0000 ff01 e611 c0a8 02c8  E..2O<..........
        0x0010:  c0a8 0264 0000 c823 6c1e 0a00 6461 7461  ...d...#l...data
        0x0020:  2069 6e20 6d79 2049 434d 5020 7061 636b  .in.my.ICMP.pack
        0x0030:  6574                                     et

TCP Packete with hping
Syn packets to port 80 on host 192.168.2.200

	hping 192.168.2.200 -p 80 -S

Syn packets to port 80 on host 192.168.2.200 with spoof source address 192.168.2.1

	hping 192.168.2.200 -p 80 -S -a 192.168.2.1

Syn Scanning Scanning

	hping -S 192.168.2.200 -p ++0 --fast

and the answer is:

	HPING 192.168.2.200 (eth0 192.168.2.200): S set, 40 headers + 0 data bytes
	len=46 ip=192.168.2.200 ttl=255 id=31515 sport=0 flags=RA seq=0 win=0 rtt=0.5 ms
	len=46 ip=192.168.2.200 ttl=255 id=31516 sport=1 flags=RA seq=1 win=0 rtt=0.5 ms
	len=46 ip=192.168.2.200 ttl=255 id=31518 sport=2 flags=RA seq=2 win=0 rtt=0.5 ms
	len=46 ip=192.168.2.200 ttl=255 id=31519 sport=3 flags=RA seq=3 win=0 rtt=0.6 ms
	len=46 ip=192.168.2.200 ttl=255 id=31520 sport=4 flags=RA seq=4 win=0 rtt=3.8 ms
	len=46 ip=192.168.2.200 ttl=255 id=31521 sport=5 flags=RA seq=5 win=0 rtt=0.5 ms
	.
	.
	len=46 ip=192.168.2.200 ttl=255 id=31547 sport=21 flags=RA seq=21 win=0 rtt=0.5 ms
	len=46 ip=192.168.2.200 ttl=255 id=31548 sport=22 flags=RA seq=22 win=0 rtt=2.7 ms
	len=46 ip=192.168.2.200 ttl=255 id=31549 sport=23 flags=SA seq=23 win=2048 rtt=2.1 ms	
	len=46 ip=192.168.2.200 ttl=255 id=31550 sport=24 flags=RA seq=24 win=0 rtt=0.5 ms

if the answer is SA (Syn/Ack) not RA (reset/ack), there is a open Port

	hping -S 192.168.2.200 -p ++0 --fast | fgrep "flags=SA"
	len=46 ip=192.168.2.200 ttl=255 id=32193 sport=23 flags=SA seq=23 win=2048 rtt=0.7 ms
	len=46 ip=192.168.2.200 ttl=255 id=32275 sport=80 flags=SA seq=80 win=2048 rtt=0.8 ms

DSCP
Samples for setting DSCP Bits

	hping 192.168.3.1 --tos 28 -S -a 192.168.2.99 -p 80     (0x28)
	hping 192.168.3.1 --tos 58 -S -a 192.168.2.99 -p 80     (0x58)
	hping 192.168.3.1 --tos B8 -S -a 192.168.2.99 -p 80     (0xB8)

Flooding
Syn Flooding
normal, ever sec a packet is send, to do this faster user following options

	-i n: alle n Sekunden
    	-i un: alle n Mikrosekunden (ein Millionstel einer Sekunde)
    	--fast: 10 Mal in der Sekunde (wie -i u100000)

samples:

	hping 192.168.1.1 --fast -p 80 -S -c 100000    
	hping3 --udp --flood -p 53 192.168.1.1

Other Samples found on the internet

hping3 -c 1 --syn -p 80 192.168.2.1
hping3 -c 1 --syn -p 80 192.168.2.1
hping3 -c 1 --fin --push --urg -p 80 192.168.2.1
hping3 -c 1 --ack -p 80 192.168.2.1
hping3 -c 1 --udp -p 53 192.168.2.1
hping3 -c 1 --rawip --ipproto  0 192.168.2.1
hping3 -c 1 --icmp  192.168.2.1
hping3 -c 1 --rawip --ipproto 2 192.168.2.1
hping -c 1 --icmp-ts 192.168.2.200 
hping --icmp-addr -c 1 10.10.10.255
hping --udp -c 1 -p 1 10.10.10.10
hping -V -c 1 10.10.10.10
hping -V -c 1 --icmptype 10 10.10.10.254
hping –a 10.10.10.3 –S 10.10.10.10 –p 80 –i u10000

hping3

comming soon.....

help

$ hping --help
usage: hping host [options]
  -h  --help      show this help
  -v  --version   show version
  -c  --count     packet count
  -i  --interval  wait (uX for X microseconds, for example -i u1000)
      --fast      alias for -i u10000 (10 packets for second)
  -n  --numeric   numeric output
  -q  --quiet     quiet
  -I  --interface interface name (otherwise default routing interface)
  -V  --verbose   verbose mode
  -D  --debug     debugging info
  -z  --bind      bind ctrl+z to ttl           (default to dst port)
  -Z  --unbind    unbind ctrl+z
Mode
  default mode     TCP
  -0  --rawip      RAW IP mode
  -1  --icmp       ICMP mode
  -2  --udp        UDP mode
  -8  --scan       SCAN mode.
                   Example: hping --scan 1-30,70-90 -S www.target.host
  -9  --listen     listen mode
IP
  -a  --spoof      spoof source address
  --rand-dest      random destionation address mode. see the man.
  --rand-source    random source address mode. see the man.
  -t  --ttl        ttl (default 64)
  -N  --id         id (default random)
  -W  --winid      use win* id byte ordering
  -r  --rel        relativize id field          (to estimate host traffic)
  -f  --frag       split packets in more frag.  (may pass weak acl)
  -x  --morefrag   set more fragments flag
  -y  --dontfrag   set dont fragment flag
  -g  --fragoff    set the fragment offset
  -m  --mtu        set virtual mtu, implies --frag if packet size > mtu
  -o  --tos        type of service (default 0x00), try --tos help
  -G  --rroute     includes RECORD_ROUTE option and display the route buffer
  --lsrr           loose source routing and record route
  --ssrr           strict source routing and record route
  -H  --ipproto    set the IP protocol field, only in RAW IP mode
ICMP
  -C  --icmptype   icmp type (default echo request)
  -K  --icmpcode   icmp code (default 0)
      --force-icmp send all icmp types (default send only supported types)
      --icmp-gw    set gateway address for ICMP redirect (default 0.0.0.0)
      --icmp-ts    Alias for --icmp --icmptype 13 (ICMP timestamp)
      --icmp-addr  Alias for --icmp --icmptype 17 (ICMP address subnet mask)
      --icmp-help  display help for others icmp options
UDP/TCP
  -s  --baseport   base source port             (default random)
  -p  --destport   [+][+] destination port(default 0) ctrl+z inc/dec
  -k  --keep       keep still source port
  -w  --win        winsize (default 64)
  -O  --tcpoff     set fake tcp data offset     (instead of tcphdrlen / 4)
  -Q  --seqnum     shows only tcp sequence number
  -b  --badcksum   (try to) send packets with a bad IP checksum
                   many systems will fix the IP checksum sending the packet
                   so you'll get bad UDP/TCP checksum instead.
  -M  --setseq     set TCP sequence number
  -L  --setack     set TCP ack
  -F  --fin        set FIN flag
  -S  --syn        set SYN flag
  -R  --rst        set RST flag
  -P  --push       set PUSH flag
  -A  --ack        set ACK flag
  -U  --urg        set URG flag
  -X  --xmas       set X unused flag (0x40)
  -Y  --ymas       set Y unused flag (0x80)
  --tcpexitcode    use last tcp->th_flags as exit code
  --tcp-timestamp  enable the TCP timestamp option to guess the HZ/uptime
Common
  -d  --data       data size                    (default is 0)
  -E  --file       data from file
  -e  --sign       add 'signature'
  -j  --dump       dump packets in hex
  -J  --print      dump printable characters
  -B  --safe       enable 'safe' protocol
  -u  --end        tell you when --file reached EOF and prevent rewind
  -T  --traceroute traceroute mode              (implies --bind and --ttl 1)
  --tr-stop        Exit when receive the first not ICMP in traceroute mode
  --tr-keep-ttl    Keep the source TTL fixed, useful to monitor just one hop
  --tr-no-rtt       Don't calculate/show RTT information in traceroute mode
ARS packet description (new, unstable)
  --apd-send       Send the packet described with APD (see docs/APD.txt)

download