NAME¶

nping - Network packet generation tool / ping utility

SYNOPSIS¶

DESCRIPTION¶

Nping is an open-source tool for network packet generation, response analysis and response time measurement. Nping allows users to generate network packets of a wide range of protocols, letting them tune virtually any field of the protocol headers. While Nping can be used as a simple ping utility to detect active hosts, it can also be used as a raw packet generator for network stack stress tests, ARP poisoning, Denial of Service attacks, route tracing, and other purposes. Additionally, Nping offers a special mode of operation called the "Echo Mode", that lets users see how the generated probes change in transit, revealing the differences between the transmitted packets and the packets received at the other end. See section "Echo Mode" for details. The output from Nping is a list of the packets that are being sent and received. The level of detail depends on the options used. A typical Nping execution is shown in Example 1. The only Nping arguments used in this example are -c, to specify the number of times to target each host, --tcp to specify TCP Probe Mode, -p 80,433 to specify the target ports; and then the two target hostnames. Example 1. A representative Nping execution

OPTIONS SUMMARY¶

This options summary is printed when Nping is run with no arguments. It helps people remember the most common options, but is no substitute for the in-depth documentation in the rest of this manual. Some obscure options aren't even included here.

TARGET SPECIFICATION¶

Everything on the Nping command line that isn't an option or an option argument is treated as a target host specification. Nping uses the same syntax for target specifications that Nmap does. The simplest case is a single target given by IP address or hostname. Nping supports CIDR-style. addressing. You can append / numbits to an IPv4 address or hostname and Nping will send probes to every IP address for which the first numbits are the same as for the reference IP or hostname given. For example, 192.168.10.0/24 would send probes to the 256 hosts between 192.168.10.0 (binary: 11000000 10101000 00001010 00000000) and 192.168.10.255 (binary: 11000000 10101000 00001010 11111111), inclusive. 192.168.10.40/24 would ping exactly the same targets. Given that the host scanme.nmap.org. is at the IP address 64.13.134.52, the specification scanme.nmap.org/16 would send probes to the 65,536 IP addresses between 64.13.0.0 and 64.13.255.255. The smallest allowed value is /0, which targets the whole Internet. The largest value is /32, which targets just the named host or IP address because all address bits are fixed. CIDR notation is short but not always flexible enough. For example, you might want to send probes to 192.168.0.0/16 but skip any IPs ending with .0 or .255 because they may be used as subnet network and broadcast addresses. Nping supports this through octet range addressing. Rather than specify a normal IP address, you can specify a comma-separated list of numbers or ranges for each octet. For example, 192.168.0-255.1-254 will skip all addresses in the range that end in .0 or .255, and 192.168.3-5,7.1 will target the four addresses 192.168.3.1, 192.168.4.1, 192.168.5.1, and 192.168.7.1. Either side of a range may be omitted; the default values are 0 on the left and 255 on the right. Using - by itself is the same as 0-255, but remember to use 0- in the first octet so the target specification doesn't look like a command-line option. Ranges need not be limited to the final octets: the specifier 0-.-.13.37 will send probes to all IP addresses on the Internet ending in .13.37. This sort of broad sampling can be useful for Internet surveys and research. IPv6 addresses can only be specified by their fully qualified IPv6 address or hostname. CIDR and octet ranges aren't supported for IPv6 because they are rarely useful. Nping accepts multiple host specifications on the command line, and they don't need to be the same type. The command nping scanme.nmap.org 192.168.0.0/8 10.0.0,1,3-7.- does what you would expect.

OPTION SPECIFICATION¶

Nping is designed to be very flexible and fit a wide variety of needs. As with most command-line tools, its behavior can be adjusted using command-line options. These general principles apply to option arguments, unless stated otherwise. Options that take integer numbers can accept values specified in decimal, octal or hexadecimal base. When a number starts with 0x, it will be treated as hexadecimal; when it simply starts with 0, it will be treated as octal. Otherwise, Nping will assume the number has been specified in base 10. Virtually all numbers that can be supplied from the command line are unsigned so, as a general rule, the minimum value is zero. Users may also specify the word random or rand to make Nping generate a random value within the expected range. IP addresses may be given as IPv4 addresses (e.g. 192.168.1.1), IPv6 addresses (e.g. 2001:db8:85a3::8e4c:760:7146), or hostnames, which will be resolved using the default DNS server configured in the host system. Options that take MAC addresses accept the usual colon-separated 6 hex byte format (e.g. 00:50:56:d4:01:98). Hyphens may also be used instead of colons (e.g. 00-50-56-c0-00-08). The special word random or rand sets a random address and the word broadcast or bcast sets ff:ff:ff:ff:ff:ff.

GENERAL OPERATION¶

Unlike other ping and packet generation tools, Nping supports multiple target host and port specifications. While this provides great flexibility, it is not obvious how Nping handles situations where there is more than one host and/or more than one port to send probes to. This section explains how Nping behaves in these cases. When multiple target hosts are specified, Nping rotates among them in round-robin fashion. This gives slow hosts more time to send their responses before another probe is sent to them. Ports are also scheduled using round robin. So, unless only one port is specified, Nping never sends two probes to the same target host and port consecutively. The loop around targets is the “inner loop” and the loop around ports is the “outer loop”. All targets will be sent a probe for a given port before moving on to the next port. Between probes, Nping waits a configurable amount of time called the “inter-probe delay”, which is controlled by the --delay option. These examples show how it works.

PROBE MODES¶

Nping supports a wide variety of protocols. Although in some cases Nping can automatically determine the mode from the options used, it is generally a good idea to specify it explicitly. --tcp-connect (TCP Connect mode) . --tcp (TCP mode) . --udp (UDP mode) . --icmp (ICMP mode) . --arp (ARP/RARP mode) . --traceroute (Traceroute mode) .

TCP CONNECT MODE¶

-p port_spec, --dest-port port_spec (Target ports) . -g portnumber, --source-port portnumber (Spoof source port) .

TCP MODE¶

-p port_spec, --dest-port port_spec (Target ports) -g portnumber, --source-port portnumber (Spoof source port) --seq seqnumber (Sequence Number) . --flags flags (TCP Flags) . --win size (Window Size) . --badsum (Invalid Checksum) .

UDP MODE¶

-p port_spec, --dest-port port_spec (Target ports) . -g portnumber, --source-port portnumber (Spoof source port) . --badsum (Invalid Checksum)

ICMP MODE¶

--icmp-type type (ICMP type) . --icmp-code code (ICMP code) . --icmp-id id (ICMP identifier) . --icmp-seq seq (ICMP sequence) . --icmp-redirect-addr addr (ICMP Redirect address) . --icmp-param-pointer pointer (ICMP Parameter Problem pointer) . --icmp-advert-lifetime ttl (ICMP Router Advertisement Lifetime) . --icmp-advert-entry addr,pref (ICMP Router Advertisement Entry) . --icmp-orig-time timestamp (ICMP Originate Timestamp) . --icmp-recv-time timestamp (ICMP Receive Timestamp) . --icmp-trans-time timestamp (ICMP Transmit Timestamp) .

ICMP Types¶

These identifiers may be used as mnemonics for the ICMP type numbers given to the --icmp-type. option. In general there are three forms of each identifier: the full name (e.g. destination-unreachable), the short name (e.g. dest-unr), or the initials (e.g. du). In ICMP types that request something, the word "request" is omitted. echo-reply, echo-rep, er destination-unreachable, dest-unr, du source-quench, sour-que, sq redirect, redi, r echo-request, echo, e router-advertisement, rout-adv, ra router-solicitation, rout-sol, rs time-exceeded, time-exc, te parameter-problem, member-pro, pp timestamp, time, tm timestamp-reply, time-rep, tr information, info, i information-reply, info-rep, ir mask-request, mask, m mask-reply, mask-rep, mr traceroute, trace, tc

ICMP Codes¶

These identifiers may be used as mnemonics for the ICMP code numbers given to the --icmp-code. option. They are listed by the ICMP type they correspond to. Destination Unreachable Redirect Router Advertisement Time Exceeded Parameter Problem

ARP MODE¶

--arp-type type (ICMP Type) . --arp-sender-mac mac (Sender MAC address) . --arp-sender-ip addr (Sender IP address) . --arp-target-mac mac (target MAC address) . --arp-target-ip addr (target ip address) .

ARP Types¶

These identifiers may be used as mnemonics for the ARP type numbers given to the --arp-type. option. arp-request, arp, a arp-reply, arp-rep, ar rarp-request, rarp, r rarp-reply, rarp-rep, rr drarp-request, drarp, d drarp-reply, drarp-rep, dr drarp-error, drarp-err, de inarp-request, inarp, i inarp-reply, inarp-rep, ir arp-nak, an

IPV4 OPTIONS¶

-S addr, --source-ip addr (Source IP Address) . --dest-ip addr (Destination IP Address) . --tos tos (Type of Service) . --id id (Identification) . --df (Don't Fragment) . --mf (More Fragments) . --ttl hops (Time To Live) . --badsum-ip (Invalid IP checksum) . --ip-options S|R [route]|L [route]|T|U ..., --ip-options hex string (IP Options) . --mtu size (Maximum Transmission Unit) .

IPV6 OPTIONS¶

-6, --ipv6 (Use IPv6) . -S addr, --source-ip addr (Source IP Address) . --dest-ip addr (Destination IP Address) . --flow label (Flow Label) . --traffic-class class (Traffic Class) . --hop-limit hops (Hop Limit) .

ETHERNET OPTIONS¶

In most cases Nping sends packets at the raw IP level. This means that Nping creates its own IP packets and transmits them through a raw socket. However, in some cases it may be necessary to send packets at the raw Ethernet level. This happens, for example, when Nping is run under Windows (as Microsoft has disabled raw socket support since Windows XP SP2), or when Nping is asked to send ARP packets. Since in some cases it is necessary to construct ethernet frames, Nping offers some options to manipulate the different fields. --dest-mac mac (Ethernet Destination MAC Address) . --source-mac mac (Ethernet Source MAC Address) . --ether-type type (Ethertype) .

Ethernet Types¶

These identifiers may be used as mnemonics for the Ethertype numbers given to the --arp-type. option. ipv4, ip, 4 ipv6, 6 arp rarp frame-relay, frelay, fr ppp gsmp mpls mps-ual, mps mcap pppoe-discovery, pppoe-d pppoe-session, pppoe-s ctag epon pbnac stag ethexp1 ethexp2 ethoui preauth lldp mac-security, mac-sec, macsec mvrp mmrp frrr

PAYLOAD OPTIONS¶

--data hex string (Append custom binary data to sent packets) . --data-string string (Append custom string to sent packets) . --data-length len (Append random data to sent packets) .

ECHO MODE¶

The "Echo Mode" is a novel technique implemented by Nping which lets users see how network packets change in transit, from the host where they originated to the target machine. Basically, the Echo mode turns Nping into two different pieces: the Echo server and the Echo client. The Echo server is a network service that has the ability to capture packets from the network and send a copy ("echo them") to the originating client through a side TCP channel. The Echo client is the part that generates such network packets, transmits them to the server, and receives their echoed version through a side TCP channel that it has previously established with the Echo server. This scheme lets the client see the differences between the packets that it sends and what is actually received by the server. By having the server send back copies of the received packets through the side channel, things like NAT devices become immediately apparent to the client because it notices the changes in the source IP address (and maybe even source port). Other devices like those that perform traffic shaping, changing TCP window sizes or adding TCP options transparently between hosts, turn up too. The Echo mode is also useful for troubleshooting routing and firewall issues. Among other things, it can be used to determine if the traffic generated by the Nping client is being dropped in transit and never gets to its destination or if the responses are the ones that don't get back to it. Internally, client and server communicate over an encrypted and authenticated channel, using the Nping Echo Protocol (NEP), whose technical specification can be found in http://nmap.org/svn/nping/docs/EchoProtoRFC.txt The following paragraphs describe the different options available in Nping's Echo mode. --ec passphrase, --echo-client passphrase (Run Echo client) . --es passphrase, --echo-server passphrase (Run Echo server) . --ep port, --echo-port port (Set Echo TCP port number) . --nc, --no-crypto (Disable encryption and authentication) . --once (Serve one client and quit) . --safe-payloads (Zero application data before echoing a packet) . The following examples illustrate how Nping's Echo mode can be used to discover intermediate devices. Example 2. Discovering NAT devices The output clearly shows the presence of a NAT device in the client's local network. Note how the captured packet (CAPT) differs from the SENT packet: the source address for the original packets is in the reserved 10.0.0.0/8 range, while the address seen by the server is 80.38.10.21, the Internet side address of the NAT device. The source port was also modified by the device. The line starting with RCVD corresponds to the responses generated by the TCP/IP stack of the machine where the Echo server is run. Example 3. Discovering a transparent proxy In this example, the output is a bit more tricky. The absence of error messages shows that the Echo client has successfully established an Echo session with the server. However, no CAPT packets can be seen in the output. This means that none of the transmitted packets reached the server. Interestingly, a TCP SYN-ACK packet was received in response to the first TCP-SYN packet (and also, it is known that the target host does not have port 80 open). This behavior reveals the presence of a transparent web proxy cache server (which in this case is an old MS ISA server).

TIMING AND PERFORMANCE OPTIONS¶

--delay time (Delay between probes) . --rate rate (Send probes at a given rate) .

MISCELLANEOUS OPTIONS¶

-h, --help (Display help) . -V, --version (Display version) . -c rounds, --count rounds (Stop after a given number of rounds) . -e name, --interface name (Set the network interface to be used) . --privileged (Assume that the user is fully privileged) . --unprivileged (Assume that the user lacks raw socket privileges) . --send-eth (Use raw ethernet sending) . --send-ip (Send at raw IP level) . --bpf-filter filter spec --filter filter spec (Set custom BPF filter) . -H, --hide-sent (Do not display sent packets) . -N, --no-capture (Do not attempt to capture replies) .

OUTPUT OPTIONS¶

-v[level], --verbose [level] (Increase or set verbosity level) . -q[level], --reduce-verbosity [level] (Decrease verbosity level) . -d[level] (Increase or set debugging level) .

BUGS¶

Like its author, Nping isn't perfect. But you can help make it better by sending bug reports or even writing patches. If Nping doesn't behave the way you expect, first upgrade to the latest Nmap version available from http://nmap.org/download.html. If the problem persists, do some research to determine whether it has already been discovered and addressed. Try searching for the error message on our search page at http://insecure.org/search.html or at Google. Also try browsing the nmap-dev archives at http://seclists.org/. Read this full manual page as well. If nothing comes out of this, mail a bug report to <dev@nmap.org>. Please include everything you have learned about the problem, as well as what version of Nping you are running and what operating system version it is running on. Problem reports and Nping usage questions sent to <dev@nmap.org> are far more likely to be answered than those sent to Fyodor directly. If you subscribe to the nmap-dev list before posting, your message will bypass moderation and get through more quickly. Subscribe at http://nmap.org/mailman/listinfo/dev. Code patches to fix bugs are even better than bug reports. Basic instructions for creating patch files with your changes are available at https://svn.nmap.org/nmap/HACKING. Patches may be sent to nmap-dev (recommended) or to any of the authors listed in the next section directly.

AUTHORS¶

Luis MartinGarcia <luis.mgarc@gmail.com> ( http://aldabaknocking.com) Fyodor <fyodor@nmap.org> ( http://insecure.org)

NOTES¶

1.

official type numbers assigned by IANA

2.

official numbers assigned by IANA

3.

official numbers listed by the IEEE