Friday, April 29, 2011

hping2

Network Mapping -> Identify Live Hosts -> hping2

hping utility is good for many things: port scanning, firewall verification, fragmentation discovery, MTU discovery, OS fingerprinting, etc... We can fine tune most of the fields in the TCP/UDP header as it is seen from the help.

There are a couple of examples below. By default it does TCP ping.

root@bt:~# hping -h
usage: hping host [options]
-h --help show this help
-v --version show version
-c --count packet count
-i --interval wait (uX for X microseconds, for example -i u1000)
--fast alias for -i u10000 (10 packets for second)
-n --numeric numeric output
-q --quiet quiet
-I --interface interface name (otherwise default routing interface)
-V --verbose verbose mode
-D --debug debugging info
-z --bind bind ctrl+z to ttl (default to dst port)
-Z --unbind unbind ctrl+z
Mode
default mode TCP
-0 --rawip RAW IP mode
-1 --icmp ICMP mode
-2 --udp UDP mode
-8 --scan SCAN mode.
Example: hping --scan 1-30,70-90 -S www.target.host
-9 --listen listen mode
IP
-a --spoof spoof source address
--rand-dest random destionation address mode. see the man.
--rand-source random source address mode. see the man.
-t --ttl ttl (default 64)
-N --id id (default random)
-W --winid use win* id byte ordering
-r --rel relativize id field (to estimate host traffic)
-f --frag split packets in more frag. (may pass weak acl)
-x --morefrag set more fragments flag
-y --dontfrag set dont fragment flag
-g --fragoff set the fragment offset
-m --mtu set virtual mtu, implies --frag if packet size > mtu
-o --tos type of service (default 0x00), try --tos help
-G --rroute includes RECORD_ROUTE option and display the route buffer
--lsrr loose source routing and record route
--ssrr strict source routing and record route
-H --ipproto set the IP protocol field, only in RAW IP mode
ICMP
-C --icmptype icmp type (default echo request)
-K --icmpcode icmp code (default 0)
--force-icmp send all icmp types (default send only supported types)
--icmp-gw set gateway address for ICMP redirect (default 0.0.0.0)
--icmp-ts Alias for --icmp --icmptype 13 (ICMP timestamp)
--icmp-addr Alias for --icmp --icmptype 17 (ICMP address subnet mask)
--icmp-help display help for others icmp options
UDP/TCP
-s --baseport base source port (default random)
-p --destport [+][+]<port> destination port(default 0) ctrl+z inc/dec
-k --keep keep still source port
-w --win winsize (default 64)
-O --tcpoff set fake tcp data offset (instead of tcphdrlen / 4)
-Q --seqnum shows only tcp sequence number
-b --badcksum (try to) send packets with a bad IP checksum
many systems will fix the IP checksum sending the packet
so you'll get bad UDP/TCP checksum instead.
-M --setseq set TCP sequence number
-L --setack set TCP ack
-F --fin set FIN flag
-S --syn set SYN flag
-R --rst set RST flag
-P --push set PUSH flag
-A --ack set ACK flag
-U --urg set URG flag
-X --xmas set X unused flag (0x40)
-Y --ymas set Y unused flag (0x80)
--tcpexitcode use last tcp->th_flags as exit code
--tcp-timestamp enable the TCP timestamp option to guess the HZ/uptime
Common
-d --data data size (default is 0)
-E --file data from file
-e --sign add 'signature'
-j --dump dump packets in hex
-J --print dump printable characters
-B --safe enable 'safe' protocol
-u --end tell you when --file reached EOF and prevent rewind
-T --traceroute traceroute mode (implies --bind and --ttl 1)
--tr-stop Exit when receive the first not ICMP in traceroute mode
--tr-keep-ttl Keep the source TTL fixed, useful to monitor just one hop
--tr-no-rtt Don't calculate/show RTT information in traceroute mode
ARS packet description (new, unstable)
--apd-send Send the packet described with APD (see docs/APD.txt)
root@bt:~#

root@bt:~# hping 192.168.1.4
HPING 192.168.1.4 (eth0 192.168.1.4): NO FLAGS are set, 40 headers + 0 data bytes
len=46 ip=192.168.1.4 ttl=64 DF id=0 sport=0 flags=RA seq=0 win=0 rtt=0.7 ms
len=46 ip=192.168.1.4 ttl=64 DF id=0 sport=0 flags=RA seq=1 win=0 rtt=0.4 ms
len=46 ip=192.168.1.4 ttl=64 DF id=0 sport=0 flags=RA seq=2 win=0 rtt=0.4 ms
len=46 ip=192.168.1.4 ttl=64 DF id=0 sport=0 flags=RA seq=3 win=0 rtt=0.5 ms
len=46 ip=192.168.1.4 ttl=64 DF id=0 sport=0 flags=RA seq=4 win=0 rtt=0.5 ms
len=46 ip=192.168.1.4 ttl=64 DF id=0 sport=0 flags=RA seq=5 win=0 rtt=0.4 ms
len=46 ip=192.168.1.4 ttl=64 DF id=0 sport=0 flags=RA seq=6 win=0 rtt=0.5 ms
len=46 ip=192.168.1.4 ttl=64 DF id=0 sport=0 flags=RA seq=7 win=0 rtt=0.5 ms
^C
--- 192.168.1.4 hping statistic ---
8 packets transmitted, 8 packets received, 0% packet loss
round-trip min/avg/max = 0.4/0.5/0.7 ms
root@bt:~# hping 192.168.1.4 -1 -c 2
HPING 192.168.1.4 (eth0 192.168.1.4): icmp mode set, 28 headers + 0 data bytes
len=46 ip=192.168.1.4 ttl=64 id=952 icmp_seq=0 rtt=0.7 ms
len=46 ip=192.168.1.4 ttl=64 id=953 icmp_seq=1 rtt=0.6 ms

--- 192.168.1.4 hping statistic ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.6/0.6/0.7 ms
root@bt:~# hping 192.168.1.4 -8 1-100 -c 2
Scanning 192.168.1.4 (192.168.1.4), port 1-100
100 ports to scan, use -V to see all the replies
+----+-----------+---------+---+-----+-----+
|port| serv name | flags |ttl| id | win |
+----+-----------+---------+---+-----+-----+
All replies received. Done.
Not responding ports:
root@bt:~# hping 192.168.1.4 -8 1-1000 -c 2
Scanning 192.168.1.4 (192.168.1.4), port 1-1000
1000 ports to scan, use -V to see all the replies
+----+-----------+---------+---+-----+-----+
|port| serv name | flags |ttl| id | win |
+----+-----------+---------+---+-----+-----+
All replies received. Done.
Not responding ports: (111 sunrpc)

root@bt:~#
root@bt:~# hping www.google.com -y --icmp -d 1472
HPING www.google.com (eth0 209.85.149.103): icmp mode set, 28 headers + 1472 data bytes
len=92 ip=209.85.149.103 ttl=54 id=41258 icmp_seq=0 rtt=24.8 ms
len=92 ip=209.85.149.103 ttl=54 id=41259 icmp_seq=1 rtt=24.2 ms
len=92 ip=209.85.149.103 ttl=54 id=41260 icmp_seq=2 rtt=24.0 ms
^C
--- www.google.com hping statistic ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 24.0/24.3/24.8 ms
root@bt:~# hping www.google.com -y --icmp -d 1473
HPING www.google.com (eth0 209.85.149.106): icmp mode set, 28 headers + 1473 data bytes
^C
--- www.google.com hping statistic ---
4 packets transmitted, 0 packets received, 100% packet loss
round-trip min/avg/max = 0.0/0.0/0.0 ms
root@bt:~#  

Official website: http://www.hping.org/

No comments: