When it comes to penetration testing and security audits, hping is one of your best friends. Currently in its third iteration, hping has become a preferred way to generate IP packets, usually for the purpose of testing firewall and intrusion detection systems.

Because you can use hping to manipulate all of the fields, flags, and protocol types of the TCP/IP protocol suite, some users call it a packet-crafting application.

By manipulating packets, you can scan systems stealthily, generate traffic floods, and generally create packets to your heart's content. Over the years, hping has become the de facto packet generator.

Generating custom packets is nothing new. Previous tools with whiz-bang and hackerish names, such as targa, synful, papa smurf, and netdude, could help with the task of generating designer packets, but many of these older applications had problems and limitations. For example, some tools could only scan Class C IPv4 networks.

What Does hping Do?

Hping provides a single, universal solution that helps prevent many problems of the previous generation. Hping is designed to:

• scan hosts,
• assist with penetration testing,
• test intrusion detection systems,
• and send files between hosts.

In this article, I will explain how to start generating test packets with hping.

Installing hping

Hping3 is available from the project website as a source tarball [1]. If you're using an Ubuntu or Debian system, you can use either Synaptic Package Manager or apt-get for the installation. To install hping, enter the following command:

sudo apt-get install hping3.

You don't need to enable any additional repositories. Red Hat or CentOS packages are also available online [2].

Scanning Hosts

After installing hping, you are ready to get started. Suppose you want to send two TCP packets to a system named james, and you want those packets to hit port 80 on james. To do this, you would issue the command shown (with the accompanying output) in Listing 1.

In Listing 1, notice that the flags= field is set to SA, which is hping's way of telling you that port 80 is open on james. If the ports were closed, you'd see RA in the flags= field.

The -S option sends a SYN packet, which often is used to create scans that are hard for intrusion detection systems to detect and flag as threatening.

After a system replies to a SYN packet, you know that a port is listening; the intrusion detection system will treat the SYN packet as standard traffic rather than as a threat.

Figure 1 shows how to specify a more sophisticated scan that provides a nice little ASCII-based report.

Figure 1: Viewing a packet generated by hping in Wireshark.