To install:
ubuntu:~$ sudo apt-get install hping3
Reading package lists… Done
Building dependency tree Â
Reading state information… Done
The following packages were automatically installed and are no longer required:
linux-headers-2.6.35-22 linux-headers-2.6.35-22-generic
Use ‘apt-get autoremove’ to remove them.
The following NEW packages will be installed:
hping3
0 upgraded, 1 newly installed, 0 to remove and 20 not upgraded.
Need to get 104kB of archives.
After this operation, 319kB of additional disk space will be used.
Get:1 http://us.archive.ubuntu.com/ubuntu/ maverick/universe hping3 i386 3.a2.ds2-6 [104kB]
Fetched 104kB in 1s (90.0kB/s)
Selecting previously deselected package hping3.
(Reading database … 217132 files and directories currently installed.)
Unpacking hping3 (from …/hping3_3.a2.ds2-6_i386.deb) …
Processing triggers for man-db …
Setting up hping3 (3.a2.ds2-6) …
ubuntu:~$
ubuntu:~$ sudo hping3 -h
usage: hping3 host [options]
-h –help show this help
-v –version show version
-c –count packet count
-i –interval wait (uX for X microseconds, for example -i u1000)
–fast alias for -i u10000 (10 packets for second)
–faster alias for -i u1000 (100 packets for second)
–flood sent packets as fast as possible. Don’t show replies.
-n –numeric numeric output
-q –quiet quiet
-I –interface interface name (otherwise default routing interface)
-V –verbose verbose mode
-D –debug debugging info
-z –bind bind ctrl+z to ttl (default to dst port)
-Z –unbind unbind ctrl+z
–beep beep for every matching packet received
Mode
default mode TCP
-0 –rawip RAW IP mode
-1 –icmp ICMP mode
-2 –udp UDP mode
-8 –scan SCAN mode.
Example: hping –scan 1-30,70-90 -S www.target.host
-9 –listen listen mode
IP
-a –spoof spoof source address
–rand-dest random destionation address mode. see the man.
–rand-source random source address mode. see the man.
-t –ttl ttl (default 64)
-N –id id (default random)
-W –winid use win* id byte ordering
-r –rel relativize id field (to estimate host traffic)
-f –frag split packets in more frag. (may pass weak acl)
-x –morefrag set more fragments flag
-y –dontfrag set don’t fragment flag
-g –fragoff set the fragment offset
-m –mtu set virtual mtu, implies –frag if packet size > mtu
-o –tos type of service (default 0×00), try –tos help
-G –rroute includes RECORD_ROUTE option and display the route buffer
–lsrr loose source routing and record route
–ssrr strict source routing and record route
-H –ipproto set the IP protocol field, only in RAW IP mode
ICMP
-C –icmptype icmp type (default echo request)
-K –icmpcode icmp code (default 0)
–force-icmp send all icmp types (default send only supported types)
–icmp-gw set gateway address for ICMP redirect (default 0.0.0.0)
–icmp-ts Alias for –icmp –icmptype 13 (ICMP timestamp)
–icmp-addr Alias for –icmp –icmptype 17 (ICMP address subnet mask)
–icmp-help display help for others icmp options
UDP/TCP
-s –baseport base source port (default random)
-p –destport [+][+] destination port(default 0) ctrl+z inc/dec
-k –keep keep still source port
-w –win winsize (default 64)
-O –tcpoff set fake tcp data offset (instead of tcphdrlen / 4)
-Q –seqnum shows only tcp sequence number
-b –badcksum (try to) send packets with a bad IP checksum
many systems will fix the IP checksum sending the packet
so you’ll get bad UDP/TCP checksum instead.
-M –setseq set TCP sequence number
-L –setack set TCP ack
-F –fin set FIN flag
-S –syn set SYN flag
-R –rst set RST flag
-P –push set PUSH flag
-A –ack set ACK flag
-U –urg set URG flag
-X –xmas set X unused flag (0×40)
-Y –ymas set Y unused flag (0×80)
–tcpexitcode use last tcp->th_flags as exit code
–tcp-mss enable the TCP MSS option with the given value
–tcp-timestamp enable the TCP timestamp option to guess the HZ/uptime
Common
-d –data data size (default is 0)
-E –file data from file
-e –sign add ‘signature’
-j –dump dump packets in hex
-J –print dump printable characters
-B –safe enable ‘safe’ protocol
-u –end tell you when –file reached EOF and prevent rewind
-T –traceroute traceroute mode (implies –bind and –ttl 1)
–tr-stop Exit when receive the first not ICMP in traceroute mode
–tr-keep-ttl Keep the source TTL fixed, useful to monitor just one hop
–tr-no-rtt Don’t calculate/show RTT information in traceroute mode
ARS packet description (new, unstable)
–apd-send Send the packet described with APD (see docs/APD.txt)
ubuntu:~$
Here I ping www.yahoo.com on TCP port 80.
ubuntu:~$ sudo hping3 -c 3 -I eth0 -p 80 www.yahoo.com
HPING www.yahoo.com (eth0 209.191.122.70): NO FLAGS are set, 40 headers + 0 data bytes
len=46 ip=209.191.122.70 ttl=254 id=53266 sport=80 flags=RA seq=0 win=512 rtt=10.9 ms
len=46 ip=209.191.122.70 ttl=254 id=62292 sport=80 flags=RA seq=1 win=512 rtt=19.9 ms
len=46 ip=209.191.122.70 ttl=254 id=63524 sport=80 flags=RA seq=2 win=512 rtt=23.2 ms
— www.yahoo.com hping statistic —
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 10.9/18.0/23.2 ms
ubuntu:~$