Mastering hping: The Ultimate Guide to TCP/IP Packet Crafting and Analysis

hping is a powerful, open-source tool for actively probing networks by crafting and sending custom TCP/IP packets. Unlike ping (limited to ICMP) or tcpdump (passive sniffing), hping lets you manipulate every field of IPv4, TCP, UDP, and ICMP headers—making it indispensable for network troubleshooting, firewall testing, port scanning, and ethical security research.

Note: hping3 has not seen active upstream development since its last major release. While it remains available in Linux distribution repositories (Debian, Kali, Ubuntu) and is still widely used for packet crafting and network testing, consider Scapy or Nping for projects requiring ongoing maintenance and modern protocol support. hping3 does not support IPv6.

This guide will take you from hping basics to advanced packet crafting, with real-world examples, best practices, and troubleshooting tips. By the end, you’ll be able to use hping to solve complex network problems and test infrastructure like a pro.

Table of Contents#

1. Introduction to hping
2. Installation
3. Core Concepts: How hping Works
4. Basic Usage: Getting Started
5. Advanced Usage: Custom Packet Crafting
6. Best Practices for Responsible Use
7. Common Use Cases
8. Troubleshooting hping Issues
9. Alternatives to hping
10. Conclusion
11. References

Key Differentiators#

hping shines when you need granular control over traffic—e.g., testing if a firewall blocks TCP ACK packets or simulating latency over UDP.

2. Installation#

hping3 (the latest stable version) is pre-installed on many Linux distributions. Use these commands to install it elsewhere:

Debian/Ubuntu#

sudo apt update && sudo apt install hping3

RHEL/CentOS/Fedora#

sudo dnf install hping3

On older CentOS/RHEL systems, use sudo yum install hping3 instead.

macOS (via Homebrew)#

brew install hping

Note: As of 2024, hping has been disabled in Homebrew because it is no longer maintained upstream. If the above command fails, compile from source via the GitHub repository, or use a Linux VM/container instead.

Windows#

Use Windows Subsystem for Linux (WSL) or Cygwin to run hping. Native Windows support is limited.

Verify Installation#

Run:

hping3 --version

You should see output like:

hping3 version 3.a2.ds2

3. Core Concepts: How hping Works#

hping uses raw sockets to directly construct IP, TCP, UDP, and ICMP packets. Raw sockets bypass the OS’s normal network stack, giving you full control over:

• IP headers (TTL, ID, fragmentation, source IP).
• TCP headers (flags, ports, sequence numbers, window size, MSS).
• UDP headers (source/destination ports, checksum).
• ICMP types (echo request, timestamp, address mask).

Critical Terms to Know#

• TCP Flags: SYN (initiate connection), ACK (acknowledge), FIN (close connection), RST (reset), PSH (push data), URG (urgent data).
• ICMP Types: 8 (echo request), 0 (echo reply), 13 (timestamp request), 17 (address mask request).
• Raw Socket: A socket that allows direct access to the transport layer (TCP/UDP) or network layer (IP). Requires root privileges (use sudo!).

4. Basic Usage: Getting Started#

hping’s syntax follows this pattern:

sudo hping3 [options] [target]

Option Categories#

Example 1: ICMP Echo Test (Like ping)#

Send 5 ICMP echo requests to google.com:

sudo hping3 -1 -c 5 google.com

Output Explanation:

HPING google.com (eth0 142.250.190.14): icmp mode set, 28 headers + 0 data bytes
len=28 ip=142.250.190.14 ttl=118 id=54321 icmp_seq=0 rtt=18.2 ms
len=28 ip=142.250.190.14 ttl=118 id=54322 icmp_seq=1 rtt=17.9 ms
...
--- google.com hping statistic ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 17.9/18.1/18.5 ms

• len: Total packet length (IP header + ICMP header + data).
• ttl: Time to Live (decrements by 1 per router; helps trace routes).
• icmp_seq: Sequence number (matches request/reply).
• rtt: Round-trip time (latency).

Example 2: TCP SYN Ping (Bypass Firewalls)#

Many firewalls block ICMP but allow TCP. Send 3 SYN packets to example.com:80 (HTTP):

sudo hping3 -S -c 3 -p 80 example.com

Key Options:

• -S: Set the TCP SYN flag (initiates a connection).
• -p 80: Target port 80.
• -c 3: Send 3 packets (stop after that).

Output:

HPING example.com (eth0 93.184.216.34): S set, 40 headers + 0 data bytes
len=46 ip=93.184.216.34 ttl=56 id=12345 sport=80 flags=SA seq=0 win=14600 rtt=22.1 ms
len=46 ip=93.184.216.34 ttl=56 id=12345 sport=80 flags=SA seq=1 win=14600 rtt=21.8 ms
len=46 ip=93.184.216.34 ttl=56 id=12345 sport=80 flags=SA seq=2 win=14600 rtt=22.0 ms

• flags=SA: The target replied with a SYN-ACK (open port).
• sport=80: Source port (target’s listening port).

If the port was closed, you’d see flags=RA (RST-ACK) instead.

Example 3: UDP Ping#

Test UDP connectivity to a DNS server (8.8.8.8:53):

sudo hping3 -2 -c 3 -p 53 8.8.8.8

Key Option: -2 (UDP mode).
UDP is connectionless. If the port is closed, you’ll typically get an ICMP port unreachable response. If the port is open and no service responds to the empty packet, you may get no response at all. Use -V (verbose) to see if packets are sent.

5. Advanced Usage: Custom Packet Crafting#

hping’s true power lies in modifying low-level packet fields. Below are common advanced use cases.

Customize IP Headers#

Change the TTL (to simulate a distant host) and IP ID (for tracking packets):

sudo hping3 -S -p 443 -t 10 -N 6789 google.com

• -t 10: Set TTL to 10 (packets will expire after 10 hops).
• -N 6789: Set IP ID to 6789 (unique identifier for fragmented packets).

Fragment Packets#

Test if a firewall allows fragmented traffic (useful for MTU discovery):

sudo hping3 -f -d 1500 -p 80 example.com

• -f: Enable fragmentation.
• -d 1500: Add 1500 bytes of random data.

To test MTU discovery (prevent fragmentation and check for "Fragmentation needed" errors), use the -Y (or --dontfrag) option instead, which sets the Don't Fragment (DF) bit:

sudo hping3 -Y -d 1500 -p 80 example.com

If you get a Fragmentation needed error with -Y, reduce the -d value to find the maximum MTU.

Add Custom TCP Options#

Modify the TCP window size and sequence number:

sudo hping3 -S -p 443 -w 2048 -M 12345 google.com

• -w 2048: Set TCP window size to 2048 bytes.
• -M 12345: Set TCP sequence number to 12345.

Inject Custom Payloads#

Send a file (payload.txt) as the TCP data segment:

sudo hping3 -S -p 80 -d 100 -E payload.txt example.com

• -E payload.txt: Read payload from payload.txt (required -d to set number of bytes to read from file, e.g., -d 100; 0 bytes sent by default otherwise).

Listen for Responses#

Use tcpdump or Wireshark to capture responses to your hping packets (great for scripting and analysis):

# Capture ICMP responses from target with tcpdump
sudo tcpdump -i eth0 icmp and host google.com
 
# Capture TCP SYN-ACK responses from target on port 80
sudo tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack != 0 and host example.com and port 80'

hping3 displays responses directly by default, but for detailed analysis or scripting, use dedicated packet capture tools.

Scripting with hping#

Automate port scanning with a bash script:

#!/bin/bash
TARGET="example.com"
PORTS="22 80 443 3389"
 
for PORT in $PORTS; do
  echo "Testing port $PORT..."
  sudo hping3 -S -p $PORT -c 1 $TARGET | grep "flags=SA" && echo "Port $PORT is open!"
done

Save as port_scan.sh, make it executable (chmod +x port_scan.sh), and run with sudo.

6. Best Practices for Responsible Use#

hping is a powerful tool—misuse can lead to network outages or legal trouble. Follow these rules:

1. Always Get Permission#

Testing networks you don’t own is illegal in most countries. Use hping only in:

• Your personal lab.
• A network where you have written authorization.

2. Avoid Flooding#

The --flood option sends packets as fast as possible (DoS simulation). Never use it on production networks—even with permission, it can crash systems.

3. Limit Traffic Rate#

Use -c (packet count) and -i (interval) to avoid overwhelming targets:

sudo hping3 -S -p 80 -c 10 -i u500000 example.com

Sends 10 packets with a 0.5-second gap (2 packets/second).

4. Log Everything#

Save output to a file for post-analysis:

sudo hping3 -S -p 443 -c 5 google.com > hping_log.txt

5. Test in a Lab First#

Practice on a local network (e.g., a VM) before using hping on production systems.

7. Common Use Cases#

1. Port Scanning (SYN Scan)#

Simulate a "stealth" SYN scan (like nmap's -sS) using a bash loop:

for PORT in 80 443 22; do
  sudo hping3 -S -p $PORT -c 1 example.com 2>/dev/null | grep -q "flags=SA" && echo "Port $PORT is open"
done

• -S: Send SYN packets (no full connection).
• Loop through ports to check which are open (flags=SA) or closed (flags=RA).

2. Firewall Testing#

Check if a firewall blocks TCP ACK packets (common in stateful firewalls):

sudo hping3 -A -p 80 example.com

• -A: Set TCP ACK flag (acknowledges a connection).

If you get no response, the firewall is filtering ACK packets. If you get flags=R, the port is unfiltered (firewall allows ACK).

3. Latency Testing Over TCP/UDP#

Test latency for a TCP-based service (e.g., HTTPS):

sudo hping3 -S -p 443 -c 10 -i 1 google.com

For UDP (e.g., DNS):

sudo hping3 -2 -p 53 -c 10 -i 1 8.8.8.8

4. DoS Simulation (Ethical Warning!)#

Only use this in a lab! Simulate a SYN flood (overwhelm a server with half-open connections):

sudo hping3 -S -p 80 --flood example.com

• --flood: Send packets as fast as possible.

5. Troubleshoot Packet Loss#

If ping works but TCP traffic fails, use hping to isolate the issue:

sudo hping3 -S -p 443 -c 20 -V google.com

• -V: Verbose output (shows packet details).

Compare hping’s RTT to ping—if TCP has higher latency, the issue is at the transport layer (e.g., a firewall throttling TCP).

8. Troubleshooting hping Issues#

1. "Permission Denied"#

Raw sockets require root privileges. Run hping with sudo:

sudo hping3 ...

2. "No Route to Host"#

Check if the target is reachable:

ping target.com

If ping fails, fix your network routing.

3. No Responses (Even Though Port Is Open)#

Use tcpdump to verify packets are sent/received:

sudo tcpdump -i eth0 host target.com and port 80

If packets are sent but not received, the target is blocking hping (e.g., via an IDS).

4. "Fragmentation Failed"#

The target’s MTU is smaller than your packet size. Reduce -d (data size) or use -f (fragmentation).

9. Alternatives to hping#

• Scapy: A Python library for packet crafting (more flexible scripting, actively maintained, supports IPv6).
• Nping: A modern alternative from the Nmap project (actively maintained, supports IPv6, better suited for large-scale testing).
• Nmap: Better for large-scale network discovery and port scanning (easier to use, richer service detection).
• tcpdump/Wireshark: Passive capture (great for analyzing hping traffic).
• Ostinato: An open-source GUI-based packet generator with a modern interface.

10. Conclusion#

hping is a must-have tool for network engineers and ethical hackers. It lets you:

• Craft custom TCP/IP packets.
• Test firewall rules and network policies.
• Troubleshoot hard-to-reproduce issues.

But with great power comes great responsibility—always use hping ethically and legally. Start small (ICMP pings, TCP SYN scans) and work your way up to advanced packet crafting.

The best way to learn hping is to practice—set up a VM, run hping commands, and analyze the results with tcpdump.

11. References#

1. hping GitHub Repository: https://github.com/antirez/hping
2. Man Page: man hping3 (run in terminal)
3. TCP/IP Illustrated, Volume 1: A definitive guide to TCP/IP protocols (Stevens).
4. Kali Linux hping3 Documentation: https://www.kali.org/tools/hping3/
5. Nmap Network Scanning: A guide to network discovery (Lyon).

Let me know if you have any questions—happy packet crafting! 🛠️