nping (1) - Linux Manuals
nping: Network packet generation tool / ping utility
NAME
nping - Network packet generation tool / ping utility
SYNOPSIS
- nping [Options] {targets}
DESCRIPTION
Additionally, Nping offers a special mode of operation called the "Echo Mode", that lets users see how the generated probes change in transit, revealing the differences between the transmitted packets and the packets received at the other end. See section "Echo Mode" for details.
The output from Nping is a list of the packets that are being sent and received. The level of detail depends on the options used.
A typical Nping execution is shown in Example 1. The only Nping arguments used in this example are -c, to specify the number of times to target each host, --tcp to specify TCP Probe Mode, -p 80,433 to specify the target ports; and then the two target hostnames.
Example 1. A representative Nping execution
-
# nping -c 1 --tcp -p 80,433 scanme.nmap.org google.com Starting Nping ( https://nmap.org/nping ) SENT (0.0120s) TCP 96.16.226.135:50091 > 64.13.134.52:80 S ttl=64 id=52072 iplen=40 seq=1077657388 win=1480 RCVD (0.1810s) TCP 64.13.134.52:80 > 96.16.226.135:50091 SA ttl=53 id=0 iplen=44 seq=4158134847 win=5840 <mss 1460> SENT (1.0140s) TCP 96.16.226.135:50091 > 74.125.45.100:80 S ttl=64 id=13932 iplen=40 seq=1077657388 win=1480 RCVD (1.1370s) TCP 74.125.45.100:80 > 96.16.226.135:50091 SA ttl=52 id=52913 iplen=44 seq=2650443864 win=5720 <mss 1430> SENT (2.0140s) TCP 96.16.226.135:50091 > 64.13.134.52:433 S ttl=64 id=8373 iplen=40 seq=1077657388 win=1480 SENT (3.0140s) TCP 96.16.226.135:50091 > 74.125.45.100:433 S ttl=64 id=23624 iplen=40 seq=1077657388 win=1480 Statistics for host scanme.nmap.org (64.13.134.52): | Probes Sent: 2 | Rcvd: 1 | Lost: 1 (50.00%) |_ Max rtt: 169.720ms | Min rtt: 169.720ms | Avg rtt: 169.720ms Statistics for host google.com (74.125.45.100): | Probes Sent: 2 | Rcvd: 1 | Lost: 1 (50.00%) |_ Max rtt: 122.686ms | Min rtt: 122.686ms | Avg rtt: 122.686ms Raw packets sent: 4 (160B) | Rcvd: 2 (92B) | Lost: 2 (50.00%) Tx time: 3.00296s | Tx bytes/s: 53.28 | Tx pkts/s: 1.33 Rx time: 3.00296s | Rx bytes/s: 30.64 | Rx pkts/s: 0.67 Nping done: 2 IP addresses pinged in 4.01 seconds
The newest version of Nping can be obtained with Nmap at m[blue]https://nmap.orgm[]. The newest version of this man page is available at m[blue]https://nmap.org/book/nping-man.htmlm[].
-->
This options summary is printed when Nping is run with no arguments. It helps people remember the most common options, but is no substitute for the in-depth documentation in the rest of this manual. Some obscure options aren't even included here.
Everything on the Nping command line that isn't an option or an option argument is treated as a target host specification. Nping uses the same syntax for target specifications that Nmap does. The simplest case is a single target given by IP address or hostname.
Nping supports CIDR-style
addressing. You can append
/numbits
to an IPv4 address or hostname and Nping will send probes to every IP address for which the first
numbits
are the same as for the reference IP or hostname given. For example,
192.168.10.0/24
would send probes to the 256 hosts between 192.168.10.0 (binary:
11000000 10101000 00001010 00000000) and 192.168.10.255 (binary:
11000000 10101000 00001010 11111111), inclusive.
192.168.10.40/24
would ping exactly the same targets. Given that the host scanme.nmap.org
is at the IP address 64.13.134.52, the specification
scanme.nmap.org/16
would send probes to the 65,536 IP addresses between 64.13.0.0 and 64.13.255.255. The smallest allowed value is
/0, which targets the whole Internet. The largest value is
/32, which targets just the named host or IP address because all address bits are fixed.
CIDR notation is short but not always flexible enough. For example, you might want to send probes to 192.168.0.0/16 but skip any IPs ending with .0 or .255 because they may be used as subnet network and broadcast addresses. Nping supports this through octet range addressing. Rather than specify a normal IP address, you can specify a comma-separated list of numbers or ranges for each octet. For example,
192.168.0-255.1-254
will skip all addresses in the range that end in .0 or .255, and
192.168.3-5,7.1
will target the four addresses 192.168.3.1, 192.168.4.1, 192.168.5.1, and 192.168.7.1. Either side of a range may be omitted; the default values are 0 on the left and 255 on the right. Using
-
by itself is the same as
0-255, but remember to use
0-
in the first octet so the target specification doesn't look like a command-line option. Ranges need not be limited to the final octets: the specifier
0-.-.13.37
will send probes to all IP addresses on the Internet ending in .13.37. This sort of broad sampling can be useful for Internet surveys and research.
IPv6 addresses can only be specified by their fully qualified IPv6 address or hostname. CIDR and octet ranges aren't supported for IPv6 because they are rarely useful.
Nping accepts multiple host specifications on the command line, and they don't need to be the same type. The command
nping scanme.nmap.org 192.168.0.0/8 10.0.0,1,3-7.-
does what you would expect.
Nping is designed to be very flexible and fit a wide variety of needs. As with most command-line tools, its behavior can be adjusted using command-line options. These general principles apply to option arguments, unless stated otherwise.
Options that take integer numbers can accept values specified in decimal, octal or hexadecimal base. When a number starts with
0x, it will be treated as hexadecimal; when it simply starts with
0, it will be treated as octal. Otherwise, Nping will assume the number has been specified in base 10. Virtually all numbers that can be supplied from the command line are unsigned so, as a general rule, the minimum value is zero. Users may also specify the word
random
or
rand
to make Nping generate a random value within the expected range.
IP addresses may be given as IPv4 addresses (e.g.
192.168.1.1), IPv6 addresses (e.g.
2001:db8:85a3::8e4c:760:7146), or hostnames, which will be resolved using the default DNS server configured in the host system.
Options that take MAC addresses accept the usual colon-separated 6 hex byte format (e.g.
00:50:56:d4:01:98). Hyphens may also be used instead of colons (e.g.
00-50-56-c0-00-08). The special word
random
or
rand
sets a random address and the word
broadcast
or
bcast
sets ff:ff:ff:ff:ff:ff.
Unlike other ping and packet generation tools, Nping supports multiple target host and port specifications. While this provides great flexibility, it is not obvious how Nping handles situations where there is more than one host and/or more than one port to send probes to. This section explains how Nping behaves in these cases.
When multiple target hosts are specified, Nping rotates among them in round-robin fashion. This gives slow hosts more time to send their responses before another probe is sent to them. Ports are also scheduled using round robin. So, unless only one port is specified, Nping never sends two probes to the same target host and port consecutively.
The loop around targets is the
"inner loop"
and the loop around ports is the
"outer loop". All targets will be sent a probe for a given port before moving on to the next port. Between probes, Nping waits a configurable amount of time called the
"inter-probe delay", which is controlled by the
--delay
option. These examples show how it works.
Nping supports a wide variety of protocols. Although in some cases Nping can automatically determine the mode from the options used, it is generally a good idea to specify it explicitly.
--tcp-connect (TCP Connect mode)
--tcp (TCP mode)
--udp (UDP mode)
--icmp (ICMP mode)
--arp (ARP/RARP mode)
--traceroute (Traceroute mode)
-p port_spec, --dest-port port_spec (Target ports)
-g portnumber, --source-port portnumber (Spoof source port)
-p port_spec, --dest-port port_spec (Target ports)
-g portnumber, --source-port portnumber (Spoof source port)
--seq seqnumber (Sequence Number)
--flags flags (TCP Flags)
There are 8 possible flags to set:
CWR,
ECN,
URG,
ACK,
PSH,
RST,
SYN, and
FIN. The special value
ALL
means to set all flags.
NONE
means to set no flags. It is important that if you don't want any flag to be set, you request it explicitly because in some cases the SYN flag may be set by default. Here is a brief description of the meaning of each flag:
CWR (Congestion Window Reduced)
ECN (Explicit Congestion Notification)
URG (Urgent)
ACK (Acknowledgement)
PSH (Push)
RST (Reset)
SYN (Synchronize)
FIN (Finish)
--win size (Window Size)
--badsum (Invalid Checksum)
-p port_spec, --dest-port port_spec (Target ports)
-g portnumber, --source-port portnumber (Spoof source port)
--badsum (Invalid Checksum)
--icmp-type type (ICMP type)
--icmp-code code (ICMP code)
--icmp-id id (ICMP identifier)
--icmp-seq seq (ICMP sequence)
--icmp-redirect-addr addr (ICMP Redirect address)
--icmp-param-pointer pointer (ICMP Parameter Problem pointer)
--icmp-advert-lifetime ttl (ICMP Router Advertisement Lifetime)
--icmp-advert-entry addr,pref (ICMP Router Advertisement Entry)
--icmp-orig-time timestamp (ICMP Originate Timestamp)
--icmp-recv-time timestamp (ICMP Receive Timestamp)
--icmp-trans-time timestamp (ICMP Transmit Timestamp)
These identifiers may be used as mnemonics for the ICMP type numbers given to the
--icmp-type
option. In general there are three forms of each identifier: the full name (e.g.
destination-unreachable), the short name (e.g.
dest-unr), or the initials (e.g.
du). In ICMP types that request something, the word "request" is omitted.
echo-reply, echo-rep, er
destination-unreachable, dest-unr, du
source-quench, sour-que, sq
redirect, redi, r
echo-request, echo, e
router-advertisement, rout-adv, ra
router-solicitation, rout-sol, rs
time-exceeded, time-exc, te
parameter-problem, member-pro, pp
timestamp, time, tm
timestamp-reply, time-rep, tr
information, info, i
information-reply, info-rep, ir
mask-request, mask, m
mask-reply, mask-rep, mr
traceroute, trace, tc
These identifiers may be used as mnemonics for the ICMP code numbers given to the
--icmp-code
option. They are listed by the ICMP type they correspond to.
network-unreachable, netw-unr, net
host-unreachable, host-unr, host
protocol-unreachable, prot-unr, proto
port-unreachable, port-unr, port
needs-fragmentation, need-fra, frag
source-route-failed, sour-rou, routefail
network-unknown, netw-unk, net?
host-unknown, host-unk, host?
host-isolated, host-iso, isolated
network-prohibited, netw-pro, !net
host-prohibited, host-pro, !host
network-tos, unreachable-network-tos, netw-tos, tosnet
host-tos, unreachable-host-tos, toshost
communication-prohibited, comm-pro, !comm
host-precedence-violation, precedence-violation, prec-vio, violation
precedence-cutoff, prec-cut, cutoff
redirect-network, redi-net, net
redirect-host, redi-host, host
redirect-network-tos, redi-ntos, redir-ntos
redirect-host-tos, redi-htos, redir-htos
normal-advertisement, norm-adv, normal, zero, default, def
not-route-common-traffic, not-rou, mobile-ip, !route, !commontraffic
ttl-exceeded-in-transit, ttl-exc, ttl-transit
fragment-reassembly-time-exceeded, frag-exc, frag-time
pointer-indicates-error, poin-ind, pointer
missing-required-option, miss-option, option-missing
bad-length, bad-len, badlen
--arp-type type (ICMP Type)
--arp-sender-mac mac (Sender MAC address)
--arp-sender-ip addr (Sender IP address)
--arp-target-mac mac (target MAC address)
--arp-target-ip addr (target ip address)
These identifiers may be used as mnemonics for the ARP type numbers given to the
--arp-type
option.
arp-request, arp, a
arp-reply, arp-rep, ar
rarp-request, rarp, r
rarp-reply, rarp-rep, rr
drarp-request, drarp, d
drarp-reply, drarp-rep, dr
drarp-error, drarp-err, de
inarp-request, inarp, i
inarp-reply, inarp-rep, ir
arp-nak, an
-S addr, --source-ip addr (Source IP Address)
--dest-ip addr (Destination IP Address)
--tos tos (Type of Service)
--id id (Identification)
--df (Don't Fragment)
--mf (More Fragments)
--ttl hops (Time To Live)
--badsum-ip (Invalid IP checksum)
--ip-options S|R [route]|L [route]|T|U ..., --ip-options hex string (IP Options)
The most powerful way to specify IP options is to simply pass in hexadecimal data as the argument to
--ip-options. Precede each hex byte value with
\x. You may repeat certain characters by following them with an asterisk and then the number of times you wish them to repeat. For example,
\x01\x07\x04\x00*4
is the same as
\x01\x07\x04\x00\x00\x00\x00.
Note that if you specify a number of bytes that is not a multiple of four, an incorrect IP header length will be set in the IP packet. The reason for this is that the IP header length field can only express multiples of four. In those cases, the length is computed by dividing the header length by 4 and rounding down. This will affect the way the header that follows the IP header is interpreted, showing bogus information in Nping or in the output of any sniffer. Although this kind of situation might be useful for some stack stress tests, users would normally want to specify explicit padding, so the correct header length is set.
Nping also offers a shortcut mechanism for specifying options. Simply pass the letter
R,
T, or
U
to request record-route, record-timestamp, or both options together, respectively. Loose or strict source routing may be specified with an L or S followed by a space and then a space-separated list of IP addresses.
For more information and examples of using IP options with Nping, see the mailing list post at
m[blue]http://seclists.org/nmap-dev/2006/q3/0052.htmlm[].
--mtu size (Maximum Transmission Unit)
-6, --ipv6 (Use IPv6)
While IPv6 hasn't exactly taken the world by storm, it gets significant use in some (usually Asian) countries and most modern operating systems support it. To use Nping with IPv6, both the source and target of your packets must be configured for IPv6. If your ISP (like most of them) does not allocate IPv6 addresses to you, free tunnel brokers are widely available and work fine with Nping. You can use the free IPv6 tunnel broker service at
m[blue]http://www.tunnelbroker.netm[].
Please note that IPv6 support is still highly experimental and many modes and options may not work with it.
-S addr, --source-ip addr (Source IP Address)
--dest-ip addr (Destination IP Address)
--flow label (Flow Label)
--traffic-class class (Traffic Class)
--hop-limit hops (Hop Limit)
Sets the IPv6 Hop Limit field in sent packets to the given value. The Hop Limit field specifies how long the datagram is allowed to exist on the network. It represents the number of hops a packet can traverse before being dropped. As with the TTL in IPv4, IPv6 Hop Limit tries to avoid a situation in which undeliverable datagrams keep being forwarded from one router to another endlessly.
hops
must be a number in the range [0-255].
In most cases Nping sends packets at the raw IP level. This means that Nping creates its own IP packets and transmits them through a raw socket. However, in some cases it may be necessary to send packets at the raw Ethernet level. This happens, for example, when Nping is run under Windows (as Microsoft has disabled raw socket support since Windows XP SP2), or when Nping is asked to send ARP packets. Since in some cases it is necessary to construct ethernet frames, Nping offers some options to manipulate the different fields.
--dest-mac mac (Ethernet Destination MAC Address)
--source-mac mac (Ethernet Source MAC Address)
--ether-type type (Ethertype)
These identifiers may be used as mnemonics for the Ethertype numbers given to the
--arp-type
option.
ipv4, ip, 4
ipv6, 6
arp
rarp
frame-relay, frelay, fr
ppp
gsmp
mpls
mps-ual, mps
mcap
pppoe-discovery, pppoe-d
pppoe-session, pppoe-s
ctag
epon
pbnac
stag
ethexp1
ethexp2
ethoui
preauth
lldp
mac-security, mac-sec, macsec
mvrp
mmrp
frrr
--data hex string (Append custom binary data to sent packets)
--data-string string (Append custom string to sent packets)
--data-length len (Append random data to sent packets)
The "Echo Mode" is a novel technique implemented by Nping which lets users see how network packets change in transit, from the host where they originated to the target machine. Basically, the Echo mode turns Nping into two different pieces: the Echo server and the Echo client. The Echo server is a network service that has the ability to capture packets from the network and send a copy ("echo them") to the originating client through a side TCP channel. The Echo client is the part that generates such network packets, transmits them to the server, and receives their echoed version through a side TCP channel that it has previously established with the Echo server.
This scheme lets the client see the differences between the packets that it sends and what is actually received by the server. By having the server send back copies of the received packets through the side channel, things like NAT devices become immediately apparent to the client because it notices the changes in the source IP address (and maybe even source port). Other devices like those that perform traffic shaping, changing TCP window sizes or adding TCP options transparently between hosts, turn up too.
The Echo mode is also useful for troubleshooting routing and firewall issues. Among other things, it can be used to determine if the traffic generated by the Nping client is being dropped in transit and never gets to its destination or if the responses are the ones that don't get back to it.
Internally, client and server communicate over an encrypted and authenticated channel, using the Nping Echo Protocol (NEP), whose technical specification can be found in
m[blue]https://nmap.org/svn/nping/docs/EchoProtoRFC.txtm[]
The following paragraphs describe the different options available in Nping's Echo mode.
--ec passphrase, --echo-client passphrase (Run Echo client)
When running Nping as an Echo client, most options from the regular raw probe modes apply. The client may be configured to send specific probes using flags like
--tcp,
--icmp
or
--udp. Protocol header fields may be manipulated normally using the appropriate options (e.g.
--ttl,
--seq,
--icmp-type, etc.). The only exceptions are ARP-related flags, which are not supported in Echo mode, as protocols like ARP are closely related to the data link layer and its probes can't pass through different network segments.
--es passphrase, --echo-server passphrase (Run Echo server)
--ep port, --echo-port port (Set Echo TCP port number)
--nc, --no-crypto (Disable encryption and authentication)
This option must be specified if Nping was compiled without openSSL support. Note that, for technical reasons, a passphrase still needs to be supplied after the --echo-client or --echo-server flags, even though it will be ignored.
The --no-crypto flag might be useful when setting up a public Echo server, because it allows users to connect to the Echo server without the need for any passphrase or shared secret. However, it is strongly recommended to not use --no-crypto unless absolutely necessary. Public Echo servers should be configured to use the passphrase "public" or the empty passphrase (--echo-server "") as the use of cryptography does not only provide confidentiality and authentication but also message integrity.
--once (Serve one client and quit)
--safe-payloads (Zero application data before echoing a packet)
Echo servers can handle multiple simultaneous clients running multiple echo sessions in parallel. In order to determine which packet needs to be echoed to which client and through which session, the Echo server uses an heuristic algorithm. Although we have taken every security measure that we could think of to prevent that a client receives an echoed packet that it did not generate, there is always a risk that our algorithm makes a mistake and delivers a packet to the wrong client. The --safe-payloads option is useful for public echo servers or critical deployments where that kind of mistake cannot be afforded.
The following examples illustrate how Nping's Echo mode can be used to discover intermediate devices.
Example 2. Discovering NAT devices
The output clearly shows the presence of a NAT device in the client's local network. Note how the captured packet (CAPT) differs from the SENT packet: the source address for the original packets is in the reserved 10.0.0.0/8 range, while the address seen by the server is 80.38.10.21, the Internet side address of the NAT device. The source port was also modified by the device. The line starting with RCVD corresponds to the responses generated by the TCP/IP stack of the machine where the Echo server is run.
Example 3. Discovering a transparent proxy
In this example, the output is a bit more tricky. The absence of error messages shows that the Echo client has successfully established an Echo session with the server. However, no CAPT packets can be seen in the output. This means that none of the transmitted packets reached the server. Interestingly, a TCP SYN-ACK packet was received in response to the first TCP-SYN packet (and also, it is known that the target host does not have port 80 open). This behavior reveals the presence of a transparent web proxy cache server (which in this case is an old MS ISA server).
--delay time (Delay between probes)
--rate rate (Send probes at a given rate)
-h, --help (Display help)
-V, --version (Display version)
-c rounds, --count rounds (Stop after a given number of rounds)
-e name, --interface name (Set the network interface to be used)
--privileged (Assume that the user is fully privileged)
--unprivileged (Assume that the user lacks raw socket privileges)
--send-eth (Use raw ethernet sending)
--send-ip (Send at raw IP level)
--bpf-filter filter spec --filter filter spec (Set custom BPF filter)
-H, --hide-sent (Do not display sent packets)
-N, --no-capture (Do not attempt to capture replies)
-v[level], --verbose [level] (Increase or set verbosity level)
Level -4
Level -3
Level -2
Level -1
Level 0
Level 1
Level 2
Level 3
Level 4 and higher
-q[level], --reduce-verbosity [level] (Decrease verbosity level)
-d[level] (Increase or set debugging level)
Debugging output is useful when you suspect a bug in Nping, or if you are simply confused as to what Nping is doing and why. As this feature is mostly intended for developers, debug lines aren't always self-explanatory. You may get something like
If you don't understand a line, your only recourses are to ignore it, look it up in the source code, or request help from the development list (nmap-dev). Some lines are self-explanatory, but the messages become more obscure as the debug level is increased. These are the available levels:
Level 0
Level 1
Level 2
Level 3
Level 4
Level 5
Level 6
Like its authors, Nping isn't perfect. But you can help make it better by sending bug reports or even writing patches. If Nping doesn't behave the way you expect, first upgrade to the latest version available from
m[blue]https://nmap.orgm[]. If the problem persists, do some research to determine whether it has already been discovered and addressed. Try searching for the problem or error message on Google since that aggregates so many forums. If nothing comes of this, create an Issue on our tracker (m[blue]http://issues.nmap.orgm[]) and/or mail a bug report to
<dev [at] nmap.org>. If you subscribe to the nmap-dev list before posting, your message will bypass moderation and get through more quickly. Subscribe at
m[blue]https://nmap.org/mailman/listinfo/devm[]. Please include everything you have learned about the problem, as well as what version of Nping you are using and what operating system version it is running on. Other suggestions for improving Nping may be sent to the Nmap dev mailing list as well.
If you are able to write a patch improving Nping or fixing a bug, that is even better! Instructions for submitting patches or git pull requests are available from
m[blue]https://github.com/nmap/nmap/blob/master/CONTRIBUTING.mdm[]
Particularly sensitive issues such as a security reports may be sent directly to Fyodor directly at
<fyodor [at] nmap.org>. All other reports and comments should use the dev list or issue tracker instead because more people read, follow, and respond to those.
Luis MartinGarcia
<luis.mgarc [at] gmail.com>
(m[blue]http://www.luismg.comm[])
Fyodor
<fyodor [at] nmap.org>
(m[blue]http://insecure.orgm[])
Nping 0.5.59BETA1 ( https://nmap.org/nping )
Usage: nping [Probe mode] [Options] {target specification}
TARGET SPECIFICATION:
Targets may be specified as hostnames, IP addresses, networks, etc.
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
PROBE MODES:
--tcp-connect : Unprivileged TCP connect probe mode.
--tcp : TCP probe mode.
--udp : UDP probe mode.
--icmp : ICMP probe mode.
--arp : ARP/RARP probe mode.
--tr, --traceroute : Traceroute mode (can only be used with
TCP/UDP/ICMP modes).
TCP CONNECT MODE:
-p, --dest-port <port spec> : Set destination port(s).
-g, --source-port <portnumber> : Try to use a custom source port.
TCP PROBE MODE:
-g, --source-port <portnumber> : Set source port.
-p, --dest-port <port spec> : Set destination port(s).
--seq <seqnumber> : Set sequence number.
--flags <flag list> : Set TCP flags (ACK,PSH,RST,SYN,FIN...)
--ack <acknumber> : Set ACK number.
--win <size> : Set window size.
--badsum : Use a random invalid checksum.
UDP PROBE MODE:
-g, --source-port <portnumber> : Set source port.
-p, --dest-port <port spec> : Set destination port(s).
--badsum : Use a random invalid checksum.
ICMP PROBE MODE:
--icmp-type <type> : ICMP type.
--icmp-code <code> : ICMP code.
--icmp-id <id> : Set identifier.
--icmp-seq <n> : Set sequence number.
--icmp-redirect-addr <addr> : Set redirect address.
--icmp-param-pointer <pnt> : Set parameter problem pointer.
--icmp-advert-lifetime <time> : Set router advertisement lifetime.
--icmp-advert-entry <IP,pref> : Add router advertisement entry.
--icmp-orig-time <timestamp> : Set originate timestamp.
--icmp-recv-time <timestamp> : Set receive timestamp.
--icmp-trans-time <timestamp> : Set transmit timestamp.
ARP/RARP PROBE MODE:
--arp-type <type> : Type: ARP, ARP-reply, RARP, RARP-reply.
--arp-sender-mac <mac> : Set sender MAC address.
--arp-sender-ip <addr> : Set sender IP address.
--arp-target-mac <mac> : Set target MAC address.
--arp-target-ip <addr> : Set target IP address.
IPv4 OPTIONS:
-S, --source-ip : Set source IP address.
--dest-ip <addr> : Set destination IP address (used as an
alternative to {target specification} ).
--tos <tos> : Set type of service field (8bits).
--id <id> : Set identification field (16 bits).
--df : Set Don't Fragment flag.
--mf : Set More Fragments flag.
--ttl <hops> : Set time to live [0-255].
--badsum-ip : Use a random invalid checksum.
--ip-options <S|R [route]|L [route]|T|U ...> : Set IP options
--ip-options <hex string> : Set IP options
--mtu <size> : Set MTU. Packets get fragmented if MTU is
small enough.
IPv6 OPTIONS:
-6, --IPv6 : Use IP version 6.
--dest-ip : Set destination IP address (used as an
alternative to {target specification}).
--hop-limit : Set hop limit (same as IPv4 TTL).
--traffic-class <class> : : Set traffic class.
--flow <label> : Set flow label.
ETHERNET OPTIONS:
--dest-mac <mac> : Set destination mac address. (Disables
ARP resolution)
--source-mac <mac> : Set source MAC address.
--ether-type <type> : Set EtherType value.
PAYLOAD OPTIONS:
--data <hex string> : Include a custom payload.
--data-string <text> : Include a custom ASCII text.
--data-length <len> : Include len random bytes as payload.
ECHO CLIENT/SERVER:
--echo-client <passphrase> : Run Nping in client mode.
--echo-server <passphrase> : Run Nping in server mode.
--echo-port <port> : Use custom <port> to listen or connect.
--no-crypto : Disable encryption and authentication.
--once : Stop the server after one connection.
--safe-payloads : Erase application data in echoed packets.
TIMING AND PERFORMANCE:
Options which take <time> are in seconds, or append 'ms' (milliseconds),
's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m, 0.25h).
--delay <time> : Adjust delay between probes.
--rate <rate> : Send num packets per second.
MISC:
-h, --help : Display help information.
-V, --version : Display current version number.
-c, --count <n> : Stop after <n> rounds.
-e, --interface <name> : Use supplied network interface.
-H, --hide-sent : Do not display sent packets.
-N, --no-capture : Do not try to capture replies.
--privileged : Assume user is fully privileged.
--unprivileged : Assume user lacks raw socket privileges.
--send-eth : Send packets at the raw ethernet layer.
--send-ip : Send packets using raw IP sockets.
--bpf-filter <filter spec> : Specify custom BPF filter.
OUTPUT:
-v : Increment verbosity level by one.
-v[level] : Set verbosity level. E.g: -v4
-d : Increment debugging level by one.
-d[level] : Set debugging level. E.g: -d3
-q : Decrease verbosity level by one.
-q[N] : Decrease verbosity level N times
--quiet : Set verbosity and debug level to minimum.
--debug : Set verbosity and debug to the max level.
EXAMPLES:
nping scanme.nmap.org
nping --tcp -p 80 --flags rst --ttl 2 192.168.1.1
nping --icmp --icmp-type time --delay 500ms 192.168.254.254
nping --echo-server "public" -e wlan0 -vvv
nping --echo-client "public" echo.nmap.org --tcp -p1-1024 --flags ack
SEE THE MAN PAGE FOR MANY MORE OPTIONS, DESCRIPTIONS, AND EXAMPLES
TARGET SPECIFICATION
OPTION SPECIFICATION
GENERAL OPERATION
# nping --tcp -c 2 1.1.1.1 -p 100-102
Starting Nping ( https://nmap.org/nping )
SENT (0.0210s) TCP 192.168.1.77 > 1.1.1.1:100
SENT (1.0230s) TCP 192.168.1.77 > 1.1.1.1:101
SENT (2.0250s) TCP 192.168.1.77 > 1.1.1.1:102
SENT (3.0280s) TCP 192.168.1.77 > 1.1.1.1:100
SENT (4.0300s) TCP 192.168.1.77 > 1.1.1.1:101
SENT (5.0320s) TCP 192.168.1.77 > 1.1.1.1:102
# nping --tcp -c 2 1.1.1.1 2.2.2.2 3.3.3.3 -p 8080
Starting Nping ( https://nmap.org/nping )
SENT (0.0230s) TCP 192.168.0.21 > 1.1.1.1:8080
SENT (1.0240s) TCP 192.168.0.21 > 2.2.2.2:8080
SENT (2.0260s) TCP 192.168.0.21 > 3.3.3.3:8080
SENT (3.0270s) TCP 192.168.0.21 > 1.1.1.1:8080
SENT (4.0290s) TCP 192.168.0.21 > 2.2.2.2:8080
SENT (5.0310s) TCP 192.168.0.21 > 3.3.3.3:8080
# nping --tcp -c 1 --delay 500ms 1.1.1.1 2.2.2.2 3.3.3.3 -p 137-139
Starting Nping ( https://nmap.org/nping )
SENT (0.0230s) TCP 192.168.0.21 > 1.1.1.1:137
SENT (0.5250s) TCP 192.168.0.21 > 2.2.2.2:137
SENT (1.0250s) TCP 192.168.0.21 > 3.3.3.3:137
SENT (1.5280s) TCP 192.168.0.21 > 1.1.1.1:138
SENT (2.0280s) TCP 192.168.0.21 > 2.2.2.2:138
SENT (2.5310s) TCP 192.168.0.21 > 3.3.3.3:138
SENT (3.0300s) TCP 192.168.0.21 > 1.1.1.1:139
SENT (3.5330s) TCP 192.168.0.21 > 2.2.2.2:139
SENT (4.0330s) TCP 192.168.0.21 > 3.3.3.3:139
PROBE MODES
TCP CONNECT MODE
TCP MODE
UDP MODE
ICMP MODE
ICMP Types
ICMP Codes
Destination Unreachable
ARP MODE
ARP Types
IPV4 OPTIONS
IPV6 OPTIONS
ETHERNET OPTIONS
Ethernet Types
PAYLOAD OPTIONS
ECHO MODE
# nping --echo-client "public" echo.nmap.org --udp
Starting Nping ( https://nmap.org/nping )
SENT (1.0970s) UDP 10.1.20.128:53 > 178.79.165.17:40125 ttl=64 id=32523 iplen=28
CAPT (1.1270s) UDP 80.38.10.21:45657 > 178.79.165.17:40125 ttl=54 id=32523 iplen=28
RCVD (1.1570s) ICMP 178.79.165.17 > 10.1.20.128 Port unreachable (type=3/code=3) ttl=49 id=16619 iplen=56
[...]
SENT (5.1020s) UDP 10.1.20.128:53 > 178.79.165.17:40125 ttl=64 id=32523 iplen=28
CAPT (5.1335s) UDP 80.38.10.21:45657 > 178.79.165.17:40125 ttl=54 id=32523 iplen=28
RCVD (5.1600s) ICMP 178.79.165.17 > 10.1.20.128 Port unreachable (type=3/code=3) ttl=49 id=16623 iplen=56
Max rtt: 60.628ms | Min rtt: 58.378ms | Avg rtt: 59.389ms
Raw packets sent: 5 (140B) | Rcvd: 5 (280B) | Lost: 0 (0.00%)| Echoed: 5 (140B)
Tx time: 4.00459s | Tx bytes/s: 34.96 | Tx pkts/s: 1.25
Rx time: 5.00629s | Rx bytes/s: 55.93 | Rx pkts/s: 1.00
Nping done: 1 IP address pinged in 6.18 seconds
# nping --echo-client "public" echo.nmap.org --tcp -p80
Starting Nping ( https://nmap.org/nping )
SENT (1.2160s) TCP 10.0.1.77:41659 > 178.79.165.17:80 S ttl=64 id=3317 iplen=40 seq=567704200 win=1480
RCVD (1.2180s) TCP 178.79.165.17:80 > 10.0.1.77:41659 SA ttl=128 id=13177 iplen=44 seq=3647106954 win=16384 <mss 1460>
SENT (2.2150s) TCP 10.0.1.77:41659 > 178.79.165.17:80 S ttl=64 id=3317 iplen=40 seq=567704200 win=1480
SENT (3.2180s) TCP 10.0.1.77:41659 > 178.79.165.17:80 S ttl=64 id=3317 iplen=40 seq=567704200 win=1480
SENT (4.2190s) TCP 10.0.1.77:41659 > 178.79.165.17:80 S ttl=64 id=3317 iplen=40 seq=567704200 win=1480
SENT (5.2200s) TCP 10.0.1.77:41659 > 178.79.165.17:80 S ttl=64 id=3317 iplen=40 seq=567704200 win=1480
Max rtt: 2.062ms | Min rtt: 2.062ms | Avg rtt: 2.062ms
Raw packets sent: 5 (200B) | Rcvd: 1 (46B) | Lost: 4 (80.00%)| Echoed: 0 (0B)
Tx time: 4.00504s | Tx bytes/s: 49.94 | Tx pkts/s: 1.25
Rx time: 5.00618s | Rx bytes/s: 9.19 | Rx pkts/s: 0.20
Nping done: 1 IP address pinged in 6.39 seconds
TIMING AND PERFORMANCE OPTIONS
MISCELLANEOUS OPTIONS
OUTPUT OPTIONS
NSOCK (1.0000s) Callback: TIMER SUCCESS for EID 12; tcpconnect_event_handler(): Received callback of type TIMER with status SUCCESS
BUGS
AUTHORS
NOTES