HPING2(8) System Manager's Manual HPING2(8) (NAME) hping2 - () TCP/IP (SYNOPSIS) hping2 [ -hvnqVDzZ012WrfxykQbFSRPAUXYjJBuTG ] [ -c count ] [ -i wait ] [ --fast ] [ -I interface ] [ -9 signature ] [ -a host ] [ -t ttl ] [ -N ip id ] [ -H ip protocol ] [ -g fragoff ] [ -m mtu ] [ -o tos ] [ -C icmp type ] [ -K icmp code ] [ -s source port ] [ -p[+][+] dest port ] [ -w tcp window ] [ -O tcp offset ] [ -M tcp sequence number ] [ -L tcp ack ] [ -d data size ] [ -E filename ] [ -e signature ] [ --icmp-ipver version ] [ --icmp-iphlen length ] [ --icmp-iplen length ] [ --icmp-ipid id ] [ --icmp-ipproto protocol ] [ --icmp-cksum checksum ] [ --icmp-ts ] [ --icmp-addr ] [ --tcpexitcode ] [ --tcp-timestamp ] [ --tr-stop ] [ --tr-keep-ttl ] [ --tr-no-rtt ] [ --rand-dest ] [ --rand-source ] [ --beep ] hostname (DESCRIPTION) hping2 TCP/IP ping ICMP . hping2 (fragmentation) . hping2 : - (firewall) - (port scanning) - TOS ( ) . - MTU (Path MTU discovery) - . - traceroute . - Firewalk. - (OS fingerprinting). - TCP/IP. - . TCP/IP . hping2 antirez@invece.org GPL . . HPING (HPING SITE) http://www.hping.org. http://www.hping.org/download.html . (BASE OPTIONS) -h --help less (pipe) . -v --version (API) linux sock packet libpcap. -c --count count ( ) count . hping2 COUNTREACHED_TIMEOUT . COUNTREACHED_TIMEOUT hping2.h . -i --interval . --interval X wait X --interval uX wait X . . hping2 . hping2 idle/spoofing HPING2-HOWTO . --fast -i u10000. hping . --faster -i u1. --fast ;) ( ). --flood . -i u0 . -n --numeric (DNS lookup) . -q --quiet . . -I --interface interface name BSD hping2 . hping2 (non-loopback) . hping2 . : -I et eth0 ethernet0 myet1 . hping2 lo . -V --verbose (verbose). TCP : len=46 ip=192.168.1.1 flags=RA DF seq=0 ttl=255 id=0 win=0 rtt=0.4 ms tos=0 iplen=40 seq=0 ack=1380893504 sum=2010 urp=0 -D --debug hping2 . HCMP . -z --bind CTRL+Z (TTL) CTRL+Z TTL . -Z --unbind CTRL+Z hping2 . --beep ( ICMP). (PROTOCOL SELECTION) TCP . hping2 TCP (flag) (winsize) . 'ping ' ICMP . TCP (null-flag) (logs) . -0 --rawip RAW IP hping2 IP --signature / --file . --ipproto IP . -1 --icmp ICMP hping2 ICMP (echo-request) . --icmptype --icmpcode ICMP . -2 --udp UDP hping2 UDP . UDP : --baseport, --destport, --keep. -8 --scan (Scan mode) . : 1,2,3 . - 1-1000 hping ( ) . all 0-65535 known /etc/services . /etc/services : hping --scan 1-1000,8888,known -S target.host.com ! () 1-1024 /etc/services : hping --scan '1-1024,!known' -S target.host.com hping hping SYN -S TCP TTL IP . hping . : . . : hping IP (IP ID) TCP (TCP win) TTL ! . -9 --listen signature HPING2 hping2 signature () signature (dump) . hping2 --listen TEST 234-09sdflkjs45-TESThello_world hello_world . IP (IP RELATED OPTIONS) -a --spoof hostname IP . . / (spoofed/idle scanning) HPING2-HOWTO . --rand-source . hping . (stress test) IP TCP/IP . --rand-dest . hping . IP 10.0.0.x . x 0-255 . IP IPv4 hping x.x.x.x --rand-dest . --debug . . : hping --interface . -t --ttl time to live TTL ( / time to live) --traceroute --bind . `hping2 some.host.com -t 1 --traceroute'. . -N --id ip->id. id id getpid() & 0xFF (TODO) . -H --ipproto IP RAW IP. -W --winid (id) Windows* Win2k hping2 id . -r --rel (increments) id. HPING2-HOWTO . id[N]-id[N-1] . relid.c . -f --frag (fragment) IP ( ) . 'mtu ' . --mtu . -x --morefrag More Fragments IP ICMP time-exceeded during reassembly ( ) . -y --dontfrag Don't Fragment IP MTU (MTU path discovery) . -g --fragoff fragment offset value (fragment offset). -m --mtu mtu value 'mtu ' . 'mtu ' . -o --tos hex_tos (Type Of Service - TOS) --tos help . -G --rroute (Record route). RECORD_ROUTE . IP . . hping ICMP record route . IP ICMP record route TCP UDP . ICMP (ICMP RELATED OPTIONS) -C --icmptype type ICMP ICMP echo request ( --icmp ). -K --icmpcode code ICMP ( --icmp ). --icmp-ipver IP IP ICMP . --icmp-iphlen IP IP ICMP ( ). --icmp-iplen IP IP ICMP . --icmp-ipid (id) IP ICMP . --icmp-ipproto IP IP ICMP TCP . --icmp-cksum (checksum) ICMP . --icmp-ts --icmptype 13 ( / timestamp ICMP). --icmp-addr --icmptype 17 ( / address mask ICMP). TCP/UDP (TCP/UDP RELATED OPTIONS) -s --baseport source port hping2 (sequence number) . . replies.dest.port - base.source.port . . -k --keep . -p --destport [+][+]dest port . '+' ( +1024) . '+' ( ++1024) . CTRL+z . --keep --baseport . -w --win TCP. . -O --tcpoff TCP. tcphdrlen / 4 . -M --tcpseq (sequence number) TCP. -L --tcpack (ACK) TCP. -Q --seqnum . TCP . : #hping2 win98 --seqnum -p 139 -S -i u1 -I eth0 HPING uaz (eth0 192.168.4.41): S set, 40 headers + 0 data bytes 2361294848 +2361294848 2411626496 +50331648 2545844224 +134217728 2713616384 +167772160 2881388544 +167772160 3049160704 +167772160 3216932864 +167772160 3384705024 +167772160 3552477184 +167772160 3720249344 +167772160 3888021504 +167772160 4055793664 +167772160 4223565824 +167772160 . . -b --badcksum (bad checksum) UDP/TCP. --tcp-timestamp TCP (TCP timestamp) (uptime). -F --fin FIN TCP. -S --syn SYN TCP. -R --rst RST TCP. -P --push PUSH TCP. -A --ack ACK TCP. -U --urg URG TCP. -X --xmas Xmas TCP. -Y --ymas Ymas TCP. (COMMON OPTIONS) -d --data data size . : --data 40 hping2 protocol_header+40 . hping2 : HPING www.yahoo.com (ppp0 204.71.200.67): NO FLAGS are set, 40 headers + 40 data bytes -E --file filename filename . -e --sign signature signature length signature. signature length . hping . --file filename filename . -j --dump (dump) (hex). -J --print . -B --safe . /etc/passwd A B : [host_a] # hping2 host_b --udp -p 53 -d 100 --sign signature --safe --file /etc/passwd [host_b] # hping2 host_a --listen signature --safe --icmp -u --end --file filename (EOF) . . HPING2-HOWTO . -T --traceroute (Traceroute). hping2 ICMP time to live 0 during transit ttl . hping2 host --traceroute . --bind --ttl 1 . --ttl ttl . 2.0.0 RTT . --tr-keep-ttl TTL traceroute (hop) . RTT : hping2 host --traceroute --ttl 5 --tr-keep-ttl --tr-stop hping ICMP time exceeded . traceroute . --tr-no-rtt RTT traceroute. RTT ICMP time exceeded . --tcpexitcode tcp->th_flag . SYN SYN/ACK RST ( ). TCP (TCP OUTPUT FORMAT) TCP : len=46 ip=192.168.1.1 flags=RA DF seq=0 ttl=255 id=0 win=0 rtt=0.4 ms len ( ) . (padding) IP . ip IP . flags TCP : R RESET S SYN A ACK F FIN P PUSH U URGENT X 0x40 Y 0x80. DF don't fragment IP . seq TCP/UDP ICMP sequence . id IP (IP ID) . win TCP . rtt (round trip time) . hping -V : len=46 ip=192.168.1.1 flags=RA DF seq=0 ttl=255 id=0 win=0 rtt=0.4 ms tos=0 iplen=40 seq=0 ack=1223672061 sum=e61d urp=0 tos (type of service) IP . iplen IP . seq and ack (sequence) (acknowledge) TCP . sum TCP . urp (urgent pointer) TCP . UDP (UDP OUTPUT FORMAT) : len=46 ip=192.168.1.1 seq=0 ttl=64 id=0 rtt=6.0 ms TCP . ICMP (ICMP OUTPUT FORMAT) ICMP: ICMP Port Unreachable from ip=192.168.1.1 name=nano.marmoc.net . "ICMP" ICMP ( Port Unreachable) . ip IP IP ICMP name ( dns PTR) UNKNOWN . ICMP Time exceeded during transit reassembly : TTL 0 during transit from ip=192.168.1.1 name=nano.marmoc.net TTL 0 during reassembly from ip=192.70.106.25 name=UNKNOWN TTL 0 . (AUTHOR) (Salvatore Sanfilippo) AUTHORS http://www.hping.org/authors.html (BUGS) --end --safe 0x00 (pad) . (alignment) . i386 TCP/IP ( ) (bogus) . (Solaris) hping loopback . tcpdump-workers libpcap . (SEE ALSO) ping(8), traceroute(8), ifconfig(8), nmap(1) 2001 Aug 14 HPING2(8)