hping3: TCP/IP packet assembler for testing network security

1. Tool Introduction

hping3 is a versatile, command-line-oriented TCP/IP packet assembler and analyzer written by Salvatore Sanfilippo (antirez). Often described as a more flexible version of ping for TCP, UDP, ICMP, and raw IP packets, hping3 allows an operator to hand-craft nearly every field of a network packet. It supports a built-in scripting language (using the Tcl-like syntax) for advanced automation, and is widely used for firewall/IDS testing, advanced port scanning, network performance testing, path MTU discovery, remote OS fingerprinting, and TCP/IP stack auditing. It is a standard Kali Linux tool.

2. Installation

sudo apt update
sudo apt install hping3 -y

Verify:

hping3 --version

Expected output:

hping version 3, 3.a2.ds2 (Debian package)

3. Syntax

hping3 [OPTIONS] <target host>

4. Command-Line Options (Full Reference)

Mode

• -h, --help — Show help
• -v, --version — Show version
• -0, --rawip — RAW IP mode
• -1, --icmp — ICMP mode
• -2, --udp — UDP mode
• -8, --scan <ports> — Scan mode (e.g., --scan 1-1000)
• -9, --listen <signature> — Listen mode

Target/IP options

• -a, --spoof <hostname> — Spoof source address
• --rand-dest — Random destination address
• --rand-source — Random source address
• -t, --ttl <ttl> — Set time to live
• -N, --id <id> — Set IP ID field
• -W, --winid — Use win* id byte ordering
• -r, --rel — Relativize IP ID field
• -f, --frag — Split packets into fragments
• -x, --morefrag — Set the “more fragments” flag
• -y, --dontfrag — Set the “don’t fragment” flag
• -g, --fragoff <offset> — Set fragment offset
• -m, --mtu <mtu> — Set virtual MTU for fragmentation
• -o, --tos <tos> — Set Type of Service field
• -G, --rroute — Enable record route option
• --lsrr <route> — Loose source routing
• --ssrr <route> — Strict source routing
• -H, --ipproto <proto> — Set IP protocol field (RAW IP mode)

ICMP options

• -C, --icmptype <type> — ICMP type (default echo request)
• -K, --icmpcode <code> — ICMP code
• --force-icmp — Send all ICMP types (not just supported ones)
• --icmp-gw <addr> — Set gateway address for redirect ICMP
• --icmp-ts — Alias for ICMP timestamp request
• --icmp-addr — Alias for ICMP address mask request

TCP/UDP options

• -s, --baseport <port> — Set base source port
• -p, --destport <port> — Set destination port
• -k, --keep — Keep source port constant
• -w, --win <size> — Set TCP window size
• -O, --tcpoff <offset> — Set fake TCP data offset
• -Q, --seqnum — Show TCP sequence number
• -b, --badcksum — Send packets with bad/invalid checksum
• -M, --setseq <seq> — Set TCP sequence number
• -L, --setack <ack> — Set TCP ack number
• -F, --fin — Set FIN flag
• -S, --syn — Set SYN flag
• -R, --rst — Set RST flag
• -P, --push — Set PUSH flag
• -A, --ack — Set ACK flag
• -U, --urg — Set URG flag
• -X, --xmas — Set X unused flag (0x40)
• -Y, --ymas — Set Y unused flag (0x80)
• --tcpexitcode — Use last TCP->th_flags as exit code
• --tcp-mss <mss> — Enable TCP MSS option with given value
• --tcp-timestamp — Enable TCP timestamp option

Common options

• -c, --count <count> — Number of packets to send
• -i, --interval <time> — Wait interval between packets (e.g., u10 for 10 microseconds)
• --fast — Alias for -i u10000 (10 packets per second)
• --faster — Alias for -i u1000
• --flood — Send packets as fast as possible, don’t wait for replies
• -n, --numeric — Show numeric IPs, no host resolution
• -q, --quiet — Quiet mode
• -I, --interface <iface> — Set network interface
• -V, --verbose — Verbose output
• -D, --debug — Debug output
• -z, --bind — Bind ctrl+z to ttl (interactive)
• -Z, --unbind — Unbind ctrl+z
• --beep — Beep on each matching packet received

5. Basic Usage

sudo hping3 -S -p 80 -c 3 10.10.10.5

Expected output:

HPING 10.10.10.5 (eth0 10.10.10.5): S set, 40 headers + 0 data bytes
len=46 ip=10.10.10.5 ttl=64 DF id=0 sport=80 flags=SA seq=0 win=64240 rtt=0.8 ms
len=46 ip=10.10.10.5 ttl=64 DF id=0 sport=80 flags=SA seq=1 win=64240 rtt=0.7 ms
len=46 ip=10.10.10.5 ttl=64 DF id=0 sport=80 flags=SA seq=2 win=64240 rtt=0.9 ms

--- 10.10.10.5 hping statistic ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.7/0.8/0.9 ms

6. Practical Examples

Example 1 — TCP SYN “ping” to a single port (host discovery through firewalls blocking ICMP)

sudo hping3 -S -p 443 -c 3 10.10.10.5

len=46 ip=10.10.10.5 flags=SA seq=0 win=64240 rtt=1.1 ms

Example 2 — ICMP echo request (like ping)

sudo hping3 -1 -c 4 10.10.10.5

len=46 ip=10.10.10.5 ttl=64 icmp_seq=0 rtt=0.5 ms
len=46 ip=10.10.10.5 ttl=64 icmp_seq=1 rtt=0.6 ms

Example 3 — Port scan mode across a range

sudo hping3 -8 1-100 -S 10.10.10.5

Scanning 10.10.10.5 (10.10.10.5), port 1-100
100 ports to scan, use -V to see all replies
22 is open
80 is open

Example 4 — Send packets with a spoofed source address

sudo hping3 -S -a 10.10.10.99 -p 80 -c 2 10.10.10.5

len=46 ip=10.10.10.5 flags=SA seq=0 win=64240 rtt=1.0 ms

Example 5 — Firewall/ACK-filtering test

sudo hping3 -A -p 80 -c 3 10.10.10.5

len=40 ip=10.10.10.5 flags=R seq=0 win=0 rtt=0.9 ms

Example 6 — Flood mode for load/stress testing (lab environment only)

sudo hping3 -S -p 80 --flood 10.10.10.5

HPING 10.10.10.5 (eth0 10.10.10.5): S set, 40 headers + 0 data bytes
hping in flood mode, no replies will be shown

Example 7 — Traceroute-style path discovery using TCP

sudo hping3 --traceroute -S -p 80 10.10.10.5

TTL 1: 10.10.10.1 rtt=0.4 ms
TTL 2: 10.10.10.5 rtt=1.2 ms

Example 8 — Set custom TTL to test intermediate hop response

sudo hping3 -1 -t 5 -c 1 8.8.8.8

len=56 ip=203.0.113.1 ttl=245 icmp_seq=0 ICMP Time to live exceeded rtt=8.3 ms

Example 9 — Send fragmented packets to bypass simple packet filters

sudo hping3 -S -p 80 -f -c 2 10.10.10.5

len=46 ip=10.10.10.5 flags=SA seq=0 win=64240 rtt=1.4 ms

Example 10 — Xmas scan flag combination

sudo hping3 -F -P -U -p 80 -c 2 10.10.10.5

len=40 ip=10.10.10.5 flags=RA seq=0 win=0 rtt=1.0 ms

7. Common Use Cases

• Host discovery on networks where ICMP is blocked, by using TCP SYN/ACK probes to specific ports instead.
• Firewall rule and IDS/IPS testing through custom flag combinations (SYN, ACK, FIN, Xmas, Null scans).
• TCP-based traceroute when standard ICMP/UDP traceroute is blocked.
• Manual, fine-grained port scanning with full control over packet fields.
• Network performance and denial-of-service resilience testing in authorized lab environments.
• Idle scan reconnaissance and advanced OS fingerprinting research.

8. Automation with Bash

#!/bin/bash
# hping_probe.sh - probe a list of common ports via TCP SYN and log open ones
TARGET="$1"
PORTS=(21 22 23 25 80 110 143 443 3306 3389)
OUT="hping_${TARGET}.log"

echo "[*] Probing $TARGET with hping3 SYN packets..." | tee "$OUT"
for port in "${PORTS[@]}"; do
    result=$(sudo hping3 -S -p "$port" -c 2 -q "$TARGET" 2>&1)
    if echo "$result" | grep -q "flags=SA"; then
        echo "[+] Port $port OPEN" | tee -a "$OUT"
    fi
done

9. Tips and Best Practices

• hping3 requires root privileges for raw socket packet crafting — always use sudo.
• Use --fast/--faster/--flood only in controlled lab environments; flood modes can disrupt production networks and may be illegal against systems you don’t own or have authorization to test.
• When testing firewall rulesets, send single, isolated probes with -c 1 or -c 3 rather than flood mode, to cleanly interpret each response.
• Use -V (verbose) or --icmp-gw/-D (debug) when troubleshooting unexpected packet behavior.
• Combine hping3 with Wireshark or tcpdump running in parallel to visually confirm packet crafting is behaving as intended.

10. Troubleshooting

• “socket(): Operation not permitted”: run with sudo, since raw sockets require elevated privileges.
• No replies received on any probe: verify the target isn’t filtering the specific flag combination; try alternate modes (-A, -1, -2).
• Traceroute mode shows no hops: some routers silently drop TTL-exceeded ICMP replies; try alternating between TCP (-S) and ICMP (-1) traceroute modes.
• Unexpected checksum errors on the wire: check if --badcksum was accidentally set.
• hping3 hangs indefinitely: ensure a -c <count> is specified; without it, hping3 sends continuously until interrupted with Ctrl+C.

11. References

• Official hping site: http://www.hping.org/
• Kali Linux tool page: https://www.kali.org/tools/hping3/
• Man page: man hping3 (installed locally)