HPING2(8)						HPING2(8)


NAME
       hping2  -  send	arbitrary TCP/UDP/ICMP packets to network
       hosts

SYNOPSIS
       hping2 [ -hvnqVDzZ012WrfxykQFSRPAUXYjJBuTG ] [ -c count	]
       [  -i wait ] [ -I interface ] [ -9 signature ] [ -a host ]
       [ -t ttl ] [ -N ip id ] [ -H ip protocol ] [ -m mtu ] [ -o
       tos ] [ -C icmp type ] [ -K icmp code ] [ -s source port ]
       [ -p[+][+] dest port ] [ -w tcp window ] [ -O tcp offset ]
       [ -M tcp sequence number ] [ -L tcp ack ] [ -d data size ]
       [ -E filename ] [ -e signature ] [ --icmp-ipver version	]
       [  --icmp-iphlen	 length	 ]  [  --icmp-iplen  length  ]	[
       --icmp-ipid id ] [ --icmp-ipproto protocol ] [  --tcpexit-
       code ] hostname

DESCRIPTION
       hping2  is a network tool able to send custom TCP/UDP/ICMP
       packets and to display target replies  like  ping  program
       does with ICMP replies. hping2 handle fragmentation, arbi-
       trary packets body and size and can be used in  oreder  to
       transfer	 files	incapsulated  under  supported protocols.
       Using hping2 you are able to perform at least the  follow-
       ing stuff:

	- Test firewall rules
	- [spoofed] port scanning
	- Test net performance using differents protocols,
	  packet size, TOS (type of service) and fragmentation.
	- Path MTU discovery
	- Files trasfering even between really fascist firewall
	  rules.
	- Traceroute like under different protocols.
	- Firewalk like usage.
	- Remote OS fingerprint.
	- TCP/IP stack auditing.
	- A lot of others.

       It's also a good didactic tool to learn TCP/IP.	hping2 is
       developed and manteined by  antirez@invece.org  and  comes
       under  GPL version 2 of license. Developing is open so you
       can send me patches, suggestion, affronts without  inhibi-
       tions.

DOWNLOAD SITE
       primary site at http://www.kyuzz.org/antirez/hping2.html I
       want thank kyuzz@kyuzz.org for web space/band usage.  Also
       mirrors	will  be  available  ASAP,  see	 MIRRORS file for
       details.

BASE OPTIONS
       -h --help
	      Show an help screen writing to standard output,  so
	      you can pipe to less.

       -v --version
	      Show version informations and API used to access to
	      data link layer, linux sock packet or libpcap

       -c --count count
	      Stop after sending (and receiving)  count	 response
	      packets.	After  last  packet  was send hping2 wait
	      COUNTREACHED_TIMEOUT seconds target  host	 replies.
	      You  are	able to tune COUNTREACHED_TIMEOUT editing
	      hping2.h

       -i --interval
	      Wait wait seconds or micro seconds between  sending
	      each  packet.   --interval X set wait to X seconds,
	      --interval uX set wait to	 X  micro  seconds.   The
	      default  is to wait one second between each packet.
	      Using hping2 to transfer files tune this option  is
	      really  important	 in  order  to	increase transfer
	      rate. Even using hping2  to  perform  idle/spoofing
	      scanning	 you   should	tune   this  option,  see
	      HPING2-HOWTO for more information.

       -n --numeric
	      Numeric output only, No attempt  will  be	 made  to
	      lookup symbolicnames for host addresses.

       -q --quiet
	      Quiet  output. Nothing is displayed except the sum-
	      mary lines at startup time and when finished.

       -I --interface interface name
	      By default on linux  systems  hping2  uses  default
	      routing  interface  that	is obtained trought /proc
	      file system. In other systems or when there  are'nt
	      default routing interface hping2 uses the first not
	      loopback interface.  However you are able to  force
	      hping2  to  use  the  interface you need using this
	      option. Note bene: you don't need	 to  specify  the
	      whole name, for exaple -I et will match eth0 ether-
	      net0 myet1 et cetera. If	no  any	 interface  match
	      hping2 will try to use lo.

       -V --verbose
	      Enable verbose output. TCP replies will be shown as
	      following:

	      40 bytes from 192.168.4.40: flags=RA seq=0  ttl=255
	      id=19 win=0 rtt=0.1 ms
			    tos =	   0 len =	   40
			    seq =	   0 ack =  690804780
			    sum =	f4c3 urp =	    0

       -D --debug
	      Enable  debug mode, it's useful when you experience
	      enabled  you will get more information about inter-
	      face detection, data lynk layer  access,	interface
	      settings, options parsing, fragmentation, HCMP pro-
	      tocol and other stuff.

       -z --bind
	      bind CTRL+Z to time to live (TTL) so you will  able
	      to  increment/decrement  ttl  of	outgoing  packets
	      pressing CTRL+Z once or twice.

       -Z --unbind
	      unbind CTRL+Z so you will able to stop hping2

PROTOCOL SELECTION
       Default protocol is TCP, by default hping2 will	send  tcp
       headers to target host's port 0 with a winsize of 64 with-
       out any tcp flag on. Often this is the best way to  do  an
       'hide  ping', useful when target is behind a firewall that
       drop ICMP. Moreover a tcp null-flag to port  0  have  good
       probability to doesn't be logged.

       -0 --rawip
	      RAW  IP  mode,  in  this	mode  hping2 will send IP
	      header with data appended with  --signature  and/or
	      --file,  see  also --ipproto that allows you to set
	      the ip protocol field.

       -1 --icmp
	      ICMP mode, by default hping2 will send  ICMP  echo-
	      request,	you  can  set  other ICMP type/code using
	      --icmptype --icmpcode options.

       -2 --udp
	      UDP mode, by default hping2 will send udp to target
	      host's  port 0.  UDP header tunable options are the
	      following: --baseport, --destport, --keep.

       -9 --listen signature
	      HPING2 listen mode, using this option  hping2  wait
	      for  packet  that	 contain  signature and dump from
	      signature end  to	 packet's  end.	 For  example  if
	      hping2  --listen	TEST  read  a packet that contain
	      234-09sdflkjs45-TESThello_world	 will	  display
	      hello_world

IP RELATED OPTIONS
       -a --spoof hostname
	      Use  this	 option	 in  order  to set fake IP source
	      address, this option ensure that	target	will  not
	      gain  your  real	address,  however replies will be
	      send to spoofed address,	so  you	 will  can't  see
	      they.  In order to see how it's possible to perform
	      spoofed/idle scanning see the HPING2-HOWTO.

       -t --ttl time to live
	      Using this option you can set TTL (time to live) of
	      outgoing	packets,  it's	likely	that you will use
	      this with --traceroute or	 --bind	 options.  If  in
	      dubt  try	 ` hping2 some.host.com -t 1 --traceroute
	      '.

       -N --id
	      Set ip->id field. Default id  is	ramdomic  but  if
	      fragmentation  is	 turned on and id isn't specified
	      it will be getpid() & 255	 ,  to	implement  better
	      solution is in TODO list.

       -H --ipproto
	      Set the ip protocol in RAW IP mode.

       -W --winid
	      Windows*	id  has	 different byte ordering, if this
	      option is enable hping2 will display  propely  win-
	      dows replies ids.

       -r --rel
	      Display  id  increments  instead	of  id.	 See  the
	      HPING2-HOWTO  for	 more	information.   Increments
	      aren't  computed	as id[N]-id[N-1] but using packet
	      loss compentation. See relid.c  for  more	 informa-
	      tion.

       -f --frag
	      Split  packets in more fragmets, this may be useful
	      in order to test IP  stacks  fragmentation  perfor-
	      mance  and to test if some packet filter is so weak
	      that can be passed using tinny fragments	(anachro-
	      nistic).	Default	 'virtual  mtu'	 is 16 bytes. see
	      also --mtu option.

       -x --morefrag
	      Set more fragments IP flag, use this option if  you
	      need  that  target  host send an ICMP time-exceeded
	      during reassembly.

       -y --dontfrag
	      Set don't fragment IP flag, this	can  be	 used  to
	      perform MTU path discovery.

       -m --mtu mtu value
	      Set different 'virutal mtu' than 16 when fragmenta-
	      tion is enabled. If packets size	is  greater  that
	      'virtual mtu' fragmentation is automatically turned
	      on.

       -o --tos hex_tos
	      Set Type Of Service (TOS) ,  for	more  information
	      try --tos help

	      Record  route.  Includes the RECORD_ROUTE option in
	      each packet sent and displays the route  buffer  or
	      returned	packets.  Note that the IP header is only
	      large enought for	 nine  such  routes.  Many  hosts
	      ignore or discard this option. Also note that using
	      hping you are able to use record route even if tar-
	      get host filter ICMP. Record route is an IP option,
	      not an ICMP option, so you  can  use  record  route
	      option even in TCP and UDP mode.

ICMP RELATED OPTIONS
       -C --icmptype type
	      Set icmp type, default is ICMP echo request

       -K --icmpcode code
	      Set icmp code, default is 0.

       --icmp-ipver
	      Set  IP  version	of  IP header contained into ICMP
	      data, default is 4.

       --icmp-iphlen
	      Set IP header length of IP  header  contained  into
	      ICMP data, default is 5 (5 word of 32 bits).

       --icmp-iplen
	      Set  IP  packet  length of IP header contained into
	      ICMP data, default is the real length.

       --icmp-ipid
	      Set IP id of IP header contained	into  ICMP  data,
	      default is random.

       --icmp-ipproto
	      Set  IP  protocol	 of IP header contained into ICMP
	      data, default is TCP.

       --icmp-cksum
	      Set ICMP checksum, for default is the valid  check-
	      sum.


       TCP/UDP RELATED OPTIONS

       -s --baseport source port
	      hping2  uses  source port in order to guess replies
	      sequence number. It start with a base  source  port
	      number,  and  increase  this number for each packet
	      sent. When packet is received sequence  number  can
	      be      computed	   as	  replies.dest.port	-
	      base.source.port.	 Default base source port is ran-
	      domic,  using  this option you are able to set dif-
	      ferent number. If you need that source port not  be
	      incresed for each sent packet use --keep option.

       -p --destport [+][+]dest port
	      Set  destination port, default is 0. If '+' charac-
	      ter precede dest port number (i.e. +1024)	 destina-
	      tion   port   will  be  increased	 for  each  reply
	      received. If double '+' precede  dest  port  number
	      (i.e.  ++1024),  destination port will be increased
	      for each packet sent.  By default destination  port
	      can be modified interactively using CTRL+z.

       --keep keep  still  source  port,  see --baseport for more
	      information.

       -w --win
	      Set TCP window size. Default is 64.

       -O --tcpoff
	      Set fake tcp data offset.	 Normal	 data  offset  is
	      tcphdrlen / 4.

       -M --tcpseq
	      Set the TCP sequence number.

       -L --tcpack
	      Set the TCP ack.

       -Q --seqnum
	      This  option  can	 be  used  in  order  to  collect
	      sequence number generated from  target  host.  This
	      can  be  useful  when  you  need	to analyse if TCP
	      sequence number is predictable. Output example:

	      #hping2 win98 --seqnum -p 139 -S -i u1 -I eth0
	      HPING uaz (eth0 192.168.4.41): S set, 40 headers + 0 data bytes
	      2361294848 +2361294848
	      2411626496 +50331648
	      2545844224 +134217728
	      2713616384 +167772160
	      2881388544 +167772160
	      3049160704 +167772160
	      3216932864 +167772160
	      3384705024 +167772160
	      3552477184 +167772160
	      3720249344 +167772160
	      3888021504 +167772160
	      4055793664 +167772160
	      4223565824 +167772160

	      The first column reports sequence number, the  sec-
	      ond  difference  between	current and last sequence
	      number. As you can see target host sequence  number
	      is predictable.

       -F --fin
	      set FIN tcp flag.

       -S --syn
	      set SYN tcp flag.

       -R --rst
	      set RST tcp flag.

       -P --push
	      set PUSH tcp flag.

       -A --ack
	      set ACK tcp flag.

       -U --urg
	      set URG tcp flag.

       -X --xmas
	      set Xmas tcp flag.

       -Y --ymas
	      set Ymas tcp flag.

COMMON OPTIONS
       -d --data data size
	      set  packet  body	 size.	Warning,  using --data 40
	      hping2 will not generate 40 bytes packets but  pro-
	      tocol_header+40  bytes.  hping2 will display packet
	      size information as first line output,  like  this:
	      HPING  www.yahoo.com (ppp0 204.71.200.67): NO FLAGS
	      are set, 40 headers + 40 data bytes

       -E --file filename
	      Use filename contents to fill packet's data.

       -e --sign signature
	      Fill first signature length bytes of data with sig-
	      nature.	If  signature  lenght is bigger than data
	      size an error message will be display.  This option
	      can  be  used  safely  with --file filename option,
	      remainder data space will be fill using filename

       -j --dump
	      Dump received packets in hex.

       -J --print
	      Dump received packets's printable characters.

       -B --safe
	      Enable safe protocol, using this option loss  pack-
	      ets in file transfering will be resend. For example
	      in order to send file /etc/passwd from  host  A  to
	      host B you may use the following:

	      [host_a]
	      # hping2 host_b --udp -p 53 -d 100 --sign signature --safe --file /etc/passwd
	      [host_b]
	      # hping2 host_a --listen signature --safe --icmp

       -u --end
	      If  you  are using --file filename option, tell you
	      when EOF has reached. Moreover prevent  that  other
	      end  accept more packets. Please, for more informa-
	      tion see the HPING2-HOWTO.

       -T --traceroute
	      Traceroute mode.	Using  this  option  hping2  will
	      increase	ttl  for  each ICMP time to live 0 during
	      transit  received.  Try  hping2  host  --traceroute
	      --ttl 1.	This option implies --bind.

       --tcpexitcode
	      Exit with last received packet tcp->th_flag as exit
	      code. Usefull for scripts that need,  for	 example,
	      to  known	 if  the port 999 of some host reply with
	      SYN/ACK or with RST in reponse  to  SYN,	i.e.  the
	      service is up or down.

AUTHOR
       Salvatore  Sanfilippo  <antirez@invece.org>, with the help
       of people mentioned in CHANGES file.

SEE ALSO
       ping(8), traceroute(8), ifconfig(8)

