SING(8)							  SING(8)


NAME
       sing - Send ICMP Nasty Garbage packets to network hosts

SYNOPSIS
       sing  [-hVRnvqQ]	 [-c  count]  [-T  wait] [-p pattern] [-s
       datasize]  [-F  bytes]  [-i  interface]	[-S  spoof]   [-l
       preload] [-x code] [type] host

DESCRIPTION
       sing  is	 a  tool that sends ICMP packets fully customized
       from command line. The main  purpose  is	 to  replace  the
       niceful	ping  command  with  certain enhancenments as the
       ability to send/read spoofed packets, send in addition  to
       the  ECHO  REQUEST  type	 sent by default, many other ICMP
       types as	 Address  Mask	Request,  Timestamp,  Information
       Request, Router Solicitation and Router Advertisement.

       It supports also the following ICMP error types: Redirect,
       Source Quench,  Time  Exceeded,	Destination  Unreach  and
       Parameter Problem.

       The  host  destination can also be especified as a list of
       gateways (including destination) breaked by the '%' symbol
       meaning the use of a Strict Source Routing IP Option (v.g.
       router1%router2%router3%host) or the  '@'  symbol  meaning
       the  use	 of  a	Loose  Source  Routing	IP  Option  (v.g.
       router1@router2@router3@host).

       A long number of examples is given at the EXAMPLES section
       of this page that shows a real use of this program.

MOST COMMON OPTIONS
       -h, --help
	      Help screen.

       -V, --Version
	      Program version.

       -v     Verbose mode.

       -c count
	      Stop  after  sending (and receiving) count packets.
	      Information types only.

       -F bytes
	      Fragment the entire ICMP packet with bytes size  by
	      fragment.

       -i interface
	      Interface	 (name or IP address) where listen on for
	      replies.

       -l preload
	      If preload  is  specified,  sing	sends  that  many

       -q     Quiet output.  Nothing is displayed except the sum-
	      mary lines at startup time and when finished.

       -Q     Totally quiet output.  Absolutly	nothing	 is  dis-
	      played. Useful to use within shell scripts.

       -R     Use  Record  Route  IP  Header  Option  on the ICMP
	      packet.

       -s bytes|max
	      Number of garbage bytes that will be  sent  on  any
	      ICMP  packet. With max the maximum possible will be
	      sent.

       -S address
	      IP address to be used as the  source  of	the  ICMP
	      packet.  This force the use of the libpcap routines
	      that puts your network interface	into  promiscuous
	      mode  to	be  able  to  read  the replies. Only the
	      super-user may use this option.

       -T wait
	      Wait wait seconds between sending each packet.  The
	      default  is  to  wait  for  one second between each
	      packet.

       -x, --xcode code|num|max
	      ICMP code to send. Code code valid for  Destination
	      Unreach  (-du),  Redirect	 (-red) and Time Exceeded
	      (-tx) types. Numerical code can  be  specified  for
	      the  ICMP	 types	that  doesn't have (Echo Request,
	      Information Request, Address Mask	 Request,  Router
	      Solicitation,  Router Advertisement, Source Quench,
	      Parameter Problem and Timestamp). Using max an ICMP
	      code  greater  than  the admited ones will be sent.
	      See the ICMP CODES section for a long list of  code
	      types.


ICMP TYPES
       The type can be any of the following below:

       -echo, --echo_request
	      Echo  Request. Request sent to a host to receive an
	      echo reply.  This is the type sent by default. This
	      ICMP type is information.

       -tstamp, --timestamp
	      Timestamp.  Host	request	 to  receive  the time of
	      another host.  This ICMP type is information.

       -mask, --mask_req
	      Address Mask Request. Used to find out a host  net-
	      work mask.  This ICMP type is information.

       -info, --info_req
	      Information  Request.  Host  request  to receive an
	      Info Reply from another host.  This  ICMP	 type  is
	      information.

       -du, --dest_unreach
	      Destination  Unreach.  IP packet couldn't be given.
	      This ICMP type is error.

       -sq, --src_quench
	      Source Quench. IP packet is not given do a  conges-
	      tion on the net.	This ICMP type is error.

       -red, --redirect
	      Redirect.	 Request  to  forward  IP packets through
	      another router.  This ICMP type is error.

       -rta, --router_advert address[/preference]
	      Router Advertisement. Router trasmits one	 or  more
	      routers with address address and preference prefer-
	      ence.  If this is ommited, default preference 0  is
	      given.  This ICMP type is information.

       -rts, --router_solicit
	      Router Solicitation. Host requeriment for a message
	      of one or more routers.  Like the	 previous,  is	a
	      part  of the messages exchange Router Discovery and
	      this ICMP type is information.

       -tx, --time_exc
	      Time Exceeded. Time  Exceeded  for  an  IP  packet.
	      This ICMP type is error.

       -param, --param_problem
	      Parameter Problem. Erroneous value on a variable of
	      IP header.  This ICMP type is error.


LESS COMMON OPTIONS
       The options can be any of the following:

       -lt, --lifetime secs
	      Lifetime in seconds  of  the  router  announcement.
	      Only  valid  with Router Advertisement (-rta) type.
	      1800 seconds by default (30').

       -gw, --gateway address
	      Route gateway address on an ICMP	Redirect  (-red).
	      By  default  will be the spoof address (-sp), if it
	      has been specified, or the outgoing IP  address  if
	      it has not been specified.

       -dest, --route_dest address
	      Route  destination  address  on  an  ICMP	 Redirect
	      (-red). This is a required option when  sending  an
	      ICMP Redirect.

       -orig, --orig_host address
	      Original	host  within the IP header sent in the 64
	      bits data field of an ICMP error.	 By default  will
	      be  the  same  as the IP of the host that sends the
	      ICMP packet.

       -psrc, --port_src port
	      Source port (tcp or udp) within the IP header  sent
	      in  the  64  bits data field of an ICMP error. 0 by
	      default.

       -pdst, --port_dst port
	      Destination port (tcp or udp) within the IP  header
	      sent  in the 64 bits data field of an ICMP error. 0
	      by default.

       -prot, --protocol name|number
	      Protocol to be used within the IP	 header	 sent  in
	      the  64 bits data field of an ICMP error. Must be a
	      name from the /etc/protocols or a protocol  number.
	      Only  tcp, udp and icmp are fully implemented, with
	      others protocols the remaining of the 64 bits field
	      are fulfilled with 0xFF. Tcp by default.

       -id, --echo_id identificator
	      Echo identificator within the IP header sent in the
	      64 bits data field of an ICMP  error  when  the  IP
	      header  protocol	of the 64 bits data field (-prot)
	      is icmp. 0 by default.

       -seq, --echo_seq sequence
	      Echo sequence number within the IP header	 sent  in
	      the 64 bits data field of an ICMP error when the IP
	      header protocol of the 64 bits data  field  (-prot)
	      is icmp. 0 by default.

       -ptr, --pointer byte
	      Pointer  to  erroneus  byte  byte on an ICMP packet
	      ter Problem type (-param).

ICMP CODES
       Valid  codes  used  with Destination Unreach, Redirect and
       Time Exceeded types are,

       - Used with Destination Unreach type (-du):

       net-unreach  (Net  Unreachable)	The  destination  net  is
       unreachable.

       host-unreach  (Host  Unreachable)  The destination host is
       unreachable.

       prot-unreach (Protocol Unreachable)  desired  protocol  is
       unreachable to destination host.

       port-unreach  (Port  Unreachable) desired port is unreach-
       able to destination host.

       frag-needed (Fragmentation Needed and Don't  Fragment  was
       Set)  Shows that IP packet had to be fragmented because of
       its size but the sender did not allowed it because  of  DF
       (DON'T FRAGMENT) flag.

       sroute-fail  (Source  Route  Failed)  could'nt  follow the
       route indicated on IP packet.

       net-unknown (Destination Network Unknown) Destination net-
       work is unknown.

       host-unknown  (Destination  Host Unknown) Destination host
       unknown but network is.

       host-isolated (Source Host Isolated) Can't reach	 destina-
       tion host.

       net-ano	(Communication with Destination Network is Admin-
       istratively Prohibited) access network is  denied  through
       firewall or similar on receiver side.

       host-ano	 (Communication with Destination Host is Adminis-
       tratively Prohibited) access host is denied through  fire-
       wall or similar on receiver side.

       net-unr-tos  (Destination  Network Unreachable for Type of
       Service) indicates on destination network that the Type Of
       Service (TOS) applied for is not allowed.

       host-unr-tos  (Destination  Host	 Unreachable  for Type of
       Service) shows that destination host is	unreachable  with
       applied TOS.

       com-admin-prohib	 (Communication	 Administratively Prohib-
       ited) a router can't forward a packet because of	 adminis-
       trative filter.

       host-precedence-viol (Host Precedence Violation) IP packet
       precedence is not allowed.

       precedence-cutoff (Precedence cutoff in effect) a  smaller
       IP packet precedence has tried to be sent over the minimal
       impossed by network manager.


       - To be used with Redirect type (-red):

       net (Redirect Datagram for the Network) shows that  desti-
       nation is a network.

       host  (Redirect Datagram for the Host) shows that destina-
       tion is a host.

       serv-net (Redirect Datagram for the Type	 Of  Service  and
       Network) destination is a type of service and network.

       serv-host  (Redirect  Datagram for the Type Of Service and
       Host) destination is a type of service and host.

       and

       - to be used with Time Exceeded type (-tx):

       ttl (Time to Live exceeded in Transit) time is over on  an
       IP packet header packet.

       frag   (Fragment	  Reassembly  Time  Exceeded)  could  not
       reassembly all the IP packet fragments.


RETURN VALUES
       sing can be easily used	within	shell  scripts.	  Program
       returns the following values to the shell:

       Value  Meaning
       -----  -----------
       0      Received at least 1 response from destination host.
       1      General Error.
       2      Packet sent OK but received no response.
       3      Out of memory.


EXAMPLES
       - In response to a packet send with TCP	source	port  100
       and destination on port 90, we want to send and ICMP Redi-
       rect to asshole.es to modify its routing	 table	with  the
       following  data:	 10.12.12.12  as  a  gateway  to the host

       infect.comx host:

       sing  -red  -sp infect.comx -gw 10.12.12.12 -dest death.es
       -x host -prot tcp -psrc 100 -pdst 90 asshole.es

       - In response to an ICMP packet	Echo  Request  sent  with
       Echo  Request  id 100 and Echo Request sequence number 90,
       we want to send an ICMP Redirect to the host hemorroids.es
       to  modify  its routing table with the following data: the
       host pizza.death as a gateway to the host death.es,  mask-
       ing  the packet source as if iit was sent from infect.comx
       host.

       sing -red -sp infect.comx -gw pizza.death  -dest	 death.es
       -x host -prot icmp -id 100 -seq 90 hemorroids.es


       -  We  want  to send an ICMP packet Destination Unreach to
       the host 10.2.3.4 saying that our TCP port number 20  con-
       nected  with  his  TCP port 2100, is unreachable.  We mask
       ourselves as host 10.1.1.1:

       sing -du -sp 10.1.1.1 -x port-unreach -prot tcp -psrc 2100
       -pdst 20 10.2.3.4


       -  We  want  to send an ICMP packet Destination Unreach to
       host 10.2.3.4 saying that the host  inferno.hell	 and  its
       TCP  port  69, connected with his port TCP 666 in unreach-
       able. We mask ourselves as gateway router.comx:

       sing -du -sp router.comx -x host-unreach -prot  tcp  -psrc
       666 -pdst 69 -orig inferno.hell 10.2.3.4


       -  We  want  to	send  a packet ICMP Source Quench to host
       ldg02.hell in response to  a  packet  destinated	 to  host
       ldg00  with  UDP protocol, source port 100 and destination
       port 200. We mask ourselves as gateway 10.10.10.1:

       sing -sq -sp 10.10.10.1 -prot  udp  -psrc  100  -pdst  200
       -orig ldg00 ldg02.hell


       -  We  want  to	send an ICMP packet Time Exceeded to host
       ldg02.hell in response to  a  packet  destinated	 to  host
       ldg00  with  UDP protocol, source port 100 and destination
       port 200. We mask as gateway ldg04.hell:

       sing -tx -sp ldg04.hell -x frag -prot udp -psrc 100  -pdst
       200 -orig ldg00 ldg02.hell

       -  We want to send an ICMP packet Address Mask Request and
       wait 10 seconds to see the replies.  We	mask  the  packet
       with  source  address  of  10.2.3.4  and we send it to the
       address 10.0.1.255:

       sing -mask -sp 10.2.3.4 -to 10 10.0.1.255


       - We want to send an ICMP packet Timestamp to host  sepul-
       tura.hell.   We	mask  the  packet as if it were send from
       host 10.2.3.1:

       sing -tstamp --spoof 10.2.3.1 sepultura.hell


       - We want to send an ICMP packet	 Information  Request  to
       host  voucher.hell.  The source address will be our own IP
       address:

       sing -info  voucher.hell


       - We want to send an ICMP packet	 Router	 Solicitation  to
       host  lazy.hell.	 The  source  address  will be our own IP
       address:

       sing -rts  lazy.hell


       - We want to send an ICMP  packet  Echo	Request	 to  host
       lazy.hell with the data pattern 'MyNameIsGump'. The source
       address will be our own IP address:

       sing -data MyNameIsGump	 lazy.hell


       - We want to send ICMP packet Echo Request to  10.12.0.255
       with the following data pattern:

       sing -sp 192.168.0.255 -data 'D E A T H'
	 192.168.0.255


       -  We  want  to send an ICMP packet Destination Unreach to
       host destination.death but sending it with  an  ICMP  code
       bigger to the legal ones adding also 60K of garbage data:

       sing -du -x max -gbg 60000 destination.death


       -  We  want  to	send an ICMP Router Advertisement to host
       death.es, saying that the routers to use are:  router1.xtc
       with  preference	 20,  router2.xtc  with preference 50 and
       router3.xtc with default preference (0). We mask ourselves
       as fatherouter.xtc

       sing   -rta   router1.xtc/20   -rta   router2.xtc/50  -rta
       router3.xtc -sp fatherouter.xtc death.es


       - We send an ICMP Parameter Problem to host misery.es say-
       ing  that  the packet sent from the host hick.org with udp
       protocol, source port 13 and destination port 53,  has  an
       error  on  the  IP  header  byte	 13. We will also add all
       garbage bytes as possible:

       sing -sp hick.org -param -ptr 13 -prot udp -psrc 13 -pdest
       53 -gbg max misery.es


       -  We  want  to	send  an  ICMP	packet	Timestamp to host
       www.hicks.org with code 38 instead of code (0) as usual:

       sing -tstamp -x 38 www.hicks.org


       - Same as above without code 38	and  using  Loose  Source
       Routing	 between   the	 routers   cisco,  10.13.1.1  and
       wakeup.man:

       sing -tstamp cisco@10.13.1.1@wakeup.man@www.hicks.org


       - Same as above using Strict Source  Routing  between  the
       gateways:

       sing -tstamp cisco%10.13.1.1%wakeup.man%www.hicks.org


       - Using Record Route IP Option to see the route that takes
       to ftp.target.xx:

       sing -R p.target.xx


SEE ALSO
       Postel, John, "Internet Control Message Protocol	 -  DARPA
       Internet	  Program   Protocol   Specification",	RFC  792,
       USC/Information Sciences Institute, September 1981.

       Mogul, Jeffrey and John Postel, "Internet Standard Subnet-
       ting  Procedure",  RFC 950, Stanford, USC/Information Sci-
       ences Institute, August 1985.

       Braden, Robert, "Requeriments for Internet Hosts -  Commu-
       nication	  Layers",  RFC	 1122,	USC/Information	 Sciences
       Institute, October 1989.

       Deering, Stephen, "ICMP Router  Discovery  Messages",  RFC
       1256, Xerox PARC, September 1991.

       Baker,  Fred, "Requeriments for IP Version 4 Routers", RFC
       1812, Cisco Systems, June 1995.

       The Linux source code, everything referent to network code
       and to ICMP protocol.


AUTHOR
       The original ping command was written by Mike Muuss.  sing
       is original from Slay <aandres@mfom.es>












































sing v1.0	   $Date: 2000/06/19 09:08:16 $		       10


