Hping usage examples

June 6, 2009

Often considered a complementary tool to Nmap, hping is used for network scanning, as well as crafting TCP/IP packets. Please note that given the packet crafting involved, if you are running as root yet you receive an error saying that the operation is not permitted it could be due to a host firewall.

Send TCP SYN packets to port 0 on host example.com (note that hping will increment the source port by 1 for each packet sent):

hping example.com -S -V

Send TCP SYN packets to port 443 on host example.com:

hping example.com -S -V -p 443

Send TCP packets to port 443 on host example.com with the SYN + ACK flags set:

hping example.com -S -A -V -p 443

Send TCP packets to port 443 on host example.com with the SYN + ACK + FIN flags set:

hping example.com -S -A -F -V -p 443

Send TCP SYN packets every 5 seconds to port 443 on host example.com:

hping example.com -S -V -p 443 -i 5

Send TCP SYN packets every 100,000 microseconds (i.e. every 0.1 second or 10 per second) to port 443 on host example.com. Note that verbose has been removed:

hping example.com -S -p 443 -i u100000

Send TCP SYN packets every 10,000 microseconds (i.e. every 0.01 second or 100 per second) to port 443 on host example.com:

hping example.com -S -p 443 -i u10000

Send TCP SYN packets every 10,000 microseconds (i.e. every 0.01 second or 100 per second) to port 443 on host example.com. Stop after 500 packets:

hping example.com -S -p 443 -i u10000 -c 500

Send UDP packets to port 111 on host example.com (argument --udp can be substituted with -2):

hping example.com --udp -V -p 111

Send ICMP echo request packets to host example.com (argument --icmp can be substituted with -1):

hping example.com --icmp -V

Send ICMP timestamp request packets to host example.com:

hping example.com --icmp --icmp-ts -V

Portscan TCP ports 100 to 110 on host example.com (argument --scan can be substituted with -8)

hping example.com -V --scan 100-110

Send UDP packets spoofed to be from source host 192.168.1.150 to host example.com

hping example.com --udp --spoof 192.168.1.150

Send UDP packets spoofed to be from various random source IP addresses to host example.com

hping example.com --udp --rand-source

Send UDP packets with the data portion padded with 100 bytes to host example.com

hping example.com -V --udp --data 100

Send UDP packets with the data portion padded with 100 bytes but containing the contents of payload.txt to host example.com (the payload will be truncated if it is smaller than what is specified by the --data argument)

hping example.com -V --udp --file payload.txt --data 100