Content-type: text/html
The output from Nping is a list of the packets that are being sent and received. The level of detail depends on the options used.
Nping was started as a "Google Summer of Code" Project in 2009. While it is already useful for many purposes, it is still in an early stage of development so it may contain bugs and some functionality may have not been implemented yet. Please, make sure you read this man page to fully understand Nping's usage before you use it.
A typical Nping execution is shown in Example 1. The only Nping arguments used in this example are -c, to specify the number of times to target each host, --tcp to specify TCP Probe Mode, -p 80,433 to specify the target ports; and then the two target hostnames.
Example 1. A representative Nping execution
# nping -c 1 --tcp -p 80,433 scanme.nmap.org google.com Starting Nping 0.1BETA2 ( http://nmap.org/nping ) at 2009-08-04 13:48 CEST SENT (0.0120s) TCP 96.16.226.135:50091 > 64.13.134.52:80 S ttl=64 id=52072 iplen=40 seq=1077657388 win=1480 RCVD (0.1810s) TCP 64.13.134.52:80 > 96.16.226.135:50091 SA ttl=53 id=0 iplen=44 seq=4158134847 win=5840 <mss 1460> SENT (1.0140s) TCP 96.16.226.135:50091 > 74.125.45.100:80 S ttl=64 id=13932 iplen=40 seq=1077657388 win=1480 RCVD (1.1370s) TCP 74.125.45.100:80 > 96.16.226.135:50091 SA ttl=52 id=52913 iplen=44 seq=2650443864 win=5720 <mss 1430> SENT (2.0140s) TCP 96.16.226.135:50091 > 64.13.134.52:433 S ttl=64 id=8373 iplen=40 seq=1077657388 win=1480 SENT (3.0140s) TCP 96.16.226.135:50091 > 74.125.45.100:433 S ttl=64 id=23624 iplen=40 seq=1077657388 win=1480 Statistics for host scanme.nmap.org (64.13.134.52): | Probes Sent: 2 | Rcvd: 1 | Lost: 1 (50.00%) |_ Max rtt: 169.720ms | Min rtt: 169.720ms | Avg rtt: 169.720ms Statistics for host google.com (74.125.45.100): | Probes Sent: 2 | Rcvd: 1 | Lost: 1 (50.00%) |_ Max rtt: 122.686ms | Min rtt: 122.686ms | Avg rtt: 122.686ms Raw packets sent: 4 (160B) | Rcvd: 2 (92B) | Lost: 2 (50.00%) Tx time: 3.00296s | Tx bytes/s: 53.28 | Tx pkts/s: 1.33 Rx time: 3.00296s | Rx bytes/s: 30.64 | Rx pkts/s: 0.67 Nping done: 2 IP addresses pinged in 4.01 seconds
This options summary is printed when Nping is run with no arguments. It helps people remember the most common options, but is no substitute for the in-depth documentation in the rest of this manual. Some obscure options aren't even included here.
Nping 0.5.30BETA1 ( http://nmap.org/nping ) Usage: nping [Probe mode] [Options] {target specification} TARGET SPECIFICATION: Targets may be specified as hostnames, IP addresses, networks, etc. Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254 PROBE MODES: --tcp-connect : Unprivileged TCP connect probe mode. --tcp : TCP probe mode. --udp : UDP probe mode. --icmp : ICMP probe mode. --arp : ARP/RARP probe mode. --tr, --traceroute : Traceroute mode (can only be used with TCP/UDP/ICMP modes). TCP CONNECT MODE: -p, --dest-port <port spec> : Set destination port(s). TCP PROBE MODE: -g, --source-port <portnumber> : Set source port. -p, --dest-port <port spec> : Set destination port(s). --seq <seqnumber> : Set sequence number. --flags <flag list> : Set TCP flags (ACK,PSH,RST,SYN,FIN...) --ack <acknumber> : Set ACK number. --win <size> : Set window size. --badsum : Use a random invalid checksum. UDP PROBE MODE: -g, --source-port <portnumber> : Set source port. -p, --dest-port <port spec> : Set destination port(s). --badsum : Use a random invalid checksum. ICMP PROBE MODE: --icmp-type <type> : ICMP type. --icmp-code <code> : ICMP code. --icmp-id <id> : Set identifier. --icmp-seq <n> : Set sequence number. --icmp-redirect-addr <addr> : Set redirect address. --icmp-param-pointer <pnt> : Set parameter problem pointer. --icmp-advert-lifetime <time> : Set router advertisement lifetime. --icmp-advert-entry <IP,pref> : Add router advertisement entry. --icmp-orig-time <timestamp> : Set originate timestamp. --icmp-recv-time <timestamp> : Set receive timestamp. --icmp-trans-time <timestamp> : Set transmit timestamp. ARP/RARP PROBE MODE: --arp-type <type> : Type: ARP, ARP-reply, RARP, RARP-reply. --arp-sender-mac <mac> : Set sender MAC address. --arp-sender-ip <addr> : Set sender IP address. --arp-target-mac <mac> : Set target MAC address. --arp-target-ip <addr> : Set target IP address. IPv4 OPTIONS: -S, --source-ip : Set source IP address. --dest-ip <addr> : Set destination IP address (used as an alternative to {target specification} ). --tos <tos> : Set type of service field (8bits). --id <id> : Set identification field (16 bits). --df : Set Don't Fragment flag. --mf : Set More Fragments flag. --ttl <hops> : Set time to live [0-256]. --badsum-ip : Use a random invalid checksum. --ip-options <S|R [route]|L [route]|T|U ...> : Set IP options --ip-options <hex string> : Set IP options --mtu <size> : Set MTU. Packets get fragmented if MTU is small enough. IPv6 OPTIONS: -6, --IPv6 : Use IP version 6. --dest-ip : Set destination IP address (used as an alternative to {target specification}). --hop-limit : Same as IPv4 TTL. --traffic-class <class> : : Traffic class. --flow <label> : Flow label. ETHERNET OPTIONS: --dest-mac <mac> : Set destination mac address. (Disables ARP resolution) --source-mac <mac> : Set source MAC address. --ether-type <type> : Set EtherType value. PAYLOAD OPTIONS: --data <hex string> : Include a custom payload. --data-string <text> : Include a custom ASCII text. --data-length <len> : Include len random bytes as payload. TIMING AND PERFORMANCE: Options which take <time> are in milliseconds, unless you append 's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m). --delay <time> : Adjust delay between probes. --rate <rate> : Send num packets per second. MISC: -h, --help : Display help information on stdout. -V, --version : Display Nping current version number. -c, --count <n> : Stop after n rounds. -e, --interface <name> : Use supplied network interface. -H, --hide-sent : Do not display sent packets. -N, --no-capture : Do not try to capture replies. --privileged : Assume user is fully privileged. --unprivileged : Assume user lacks raw socket privileges. --send-eth : Send packets at the raw ethernet layer. --send-ip : Send packets using raw IP sockets. --bpf-filter <filter spec> : Specify custom BPF filter. OUTPUT: -v : Increment verbosity level by one. -v[level] : Set verbosity level. E.g: -v4 -d : Increment debugging level by one. -d[level] : Set debugging level. E.g: -d3 -q : Decrease verbosity level by one. -q[N] : Decrease verbosity level N times --quiet : Set verbosity and debug level to minimum. --debug : Set verbosity and debug to the max level. EXAMPLES: nping scanme.nmap.org nping --tcp -p 80 --flags rst --ttl 2 192.168.1.1 nping --icmp --icmp-type mask --delay 500 192.168.254.254 SEE THE MAN PAGE FOR MANY MORE OPTIONS, DESCRIPTIONS, AND EXAMPLES
Nping provides support for multiple target specification. Basically, everything on the Nping command-line that isn't an option (or an option argument) is treated as a target host specification. The simplest case is to specify a single target IP address or a hostname.
Sometimes you wish to ping a whole network of adjacent hosts. For this, Nping supports CIDR-style addressing. You can append /numbits to an IPv4 address or hostname and Nping will send probes to every IP address for which the first numbits are the same as for the reference IP or hostname given. For example, 192.168.10.0/24 would send probes to the 256 hosts between 192.168.10.0 (binary: 11000000 10101000 00001010 00000000) and 192.168.10.255 (binary: 11000000 10101000 00001010 11111111), inclusive. 192.168.10.40/24 would ping exactly the same targets. Given that the host scanme.nmap.org is at the IP address 64.13.134.52, the specification scanme.nmap.org/16 would send probes to the 65,536 IP addresses between 64.13.0.0 and 64.13.255.255. The smallest allowed value is /0, which targets the whole Internet. The largest value is /32, which targets just the named host or IP address because all address bits are fixed.
CIDR notation is short but not always flexible enough. For example, you might want to send probes to 192.168.0.0/16 but skip any IPs ending with .0 or .255 because they may be used as subnet network and broadcast addresses. Nping supports this through octet range addressing. Rather than specify a normal IP address, you can specify a comma-separated list of numbers or ranges for each octet. For example, 192.168.0-255.1-254 will skip all addresses in the range that end in .0 or .255, and 192.168.3-5,7.1 will target the four addresses 192.168.3.1, 192.168.4.1, 192.168.5.1, and 192.168.7.1. Either side of a range may be omitted; the default values are 0 on the left and 255 on the right. Using - by itself is the same as 0-255, but remember to use 0- in the first octet so the target specification doesn't look like a command-line option. Ranges need not be limited to the final octets: the specifier 0-.-.13.37 will send probes to all IP addresses on the Internet ending in .13.37. This sort of broad sampling can be useful for Internet surveys and research.
IPv6 addresses can only be specified by their fully qualified IPv6 address or hostname. CIDR and octet ranges aren't supported for IPv6 because they are rarely useful.
Nping accepts multiple host specifications on the command line, and they don't need to be the same type. The command nping scanme.nmap.org 192.168.0.0/8 10.0.0,1,3-7.- does what you would expect.
While targets are usually specified on the command lines, the following options are also available to control target selection:
Unlike other ping and packet generation tools, Nping supports multiple target host and multiple target port specification. While this provides great flexibility, it is not obvious how Nping handles situations where there is more than one host and/or more than one port to send probes to. This section explains how Nping behaves in these cases.
When multiple target hosts are specified, instead of sending all probes to one target and then continue with the next one, Nping uses Round Robin to select the next target host. This gives slow hosts more time to send their responses before another probe is sent to them.
Target ports are also scheduled using Round Robin. So, unless only one port is specified, Nping never sends two probes to the same target host and port consecutively.
Basically it can be seen as if it was implemented using three nested loops: one that iterates N times, where N is the number of rounds (see option --count for details), one that iterates over the specified ports and one that iterates over the specified targets. Obviously, if Nping is sending ICMP or ARP packets, there is no loop that iterates over ports. Also, note that after a probe has been sent, Nping waits a configurable amount of time called "inter-probe delay" before sending the next probe (see option --delay for details). This is how the loops look like:
loop( N rounds ){ loop( port range ){ loop ( specified targets ){ send_probe( current_target, current_port ); wait( inter-probe delay ); } } }
The following examples illustrate the described behaviour:
EXAMPLE 1: One target host, three target ports (100-102) and two rounds:
SENT (0.0000s) TCP 192.168.1.77 > 1.1.1.1:100 SENT (1.0000s) TCP 192.168.1.77 > 1.1.1.1:101 SENT (2.0000s) TCP 192.168.1.77 > 1.1.1.1:102 SENT (3.0000s) TCP 192.168.1.77 > 1.1.1.1:100 SENT (4.0000s) TCP 192.168.1.77 > 1.1.1.1:101 SENT (5.0000s) TCP 192.168.1.77 > 1.1.1.1:102
EXAMPLE 2: Three target hosts, one target port (8080), two rounds:
SENT (0.0000s) TCP 192.168.1.77 > 1.1.1.1:8080 SENT (1.0000s) TCP 192.168.1.77 > 2.2.2.2:8080 SENT (2.0000s) TCP 192.168.1.77 > 3.3.3.3:8080 SENT (3.0000s) TCP 192.168.1.77 > 1.1.1.1:8080 SENT (4.0000s) TCP 192.168.1.77 > 2.2.2.2:8080 SENT (5.0000s) TCP 192.168.1.77 > 3.3.3.3:8080
EXAMPLE 2: Three target hosts, three target ports (137-139), one round, inter-probe delay of 500ms:
SENT (0.0000s) TCP 192.168.1.77 > 1.1.1.1:137 SENT (0.5000s) TCP 192.168.1.77 > 2.2.2.2:137 SENT (1.0000s) TCP 192.168.1.77 > 3.3.3.3:137 SENT (1.5000s) TCP 192.168.1.77 > 1.1.1.1:138 SENT (2.0000s) TCP 192.168.1.77 > 2.2.2.2:138 SENT (2.5000s) TCP 192.168.1.77 > 3.3.3.3:138 SENT (3.0000s) TCP 192.168.1.77 > 1.1.1.1:139 SENT (3.5000s) TCP 192.168.1.77 > 2.2.2.2:139 SENT (4.0000s) TCP 192.168.1.77 > 3.3.3.3:139
Nping supports a wide variety of protocols. Altough in some cases Nping can automatically determine the mode from the options used, it is generally a good idea to specify it explicitly.
--tcp-connect (TCP Connect mode) .
--tcp (TCP mode) .
--udp (UDP mode) .
--icmp (ICMP mode) .
--arp (ARP/RARP mode) .
--traceroute (Traceroute mode) .
-p port_spec; --dest-port port_spec (Target ports) .
-g portnumber; --source-port portnumber (Spoof source port) .
-p port_spec; --dest-port port_spec (Target ports) .
--seq seqnumber (Sequence Number) .
--flags flags (TCP Flags) .
1. As a comma-separated list of flags (e.g: --flags syn,ack,rst)
2. As list of flag initials in the format "XYZ..." where each letter represent the initial that corresponds to the desired flag. (e.g. "--flags SAR" tells Nping to set flags SYN, ACK and RST.
3. As an 8-bit hexadecimal number, where the supplied number is the exact value that will be placed in the flags field of the tcp header. The number should start with the prefix "0x" and should be in the range [0x00-0xFF]. (e.g. "--flags 0x20" sets the URG flag as 0x20 corresponds to binary 00100000 and the URG flag is represented by the third most significant bit)
There are 8 possible flags to set: CWR, ECN, URG, ACK, PSH, RST, SYN, FIN. If "ALL" is specified, then Nping will set all flags. Alternatively if word "NONE" is supplied, all flags will be set to zero. It is important that if you don't want any flag to be set you request it explicitely because in some cases the SYN flag may be set by default. Here is a brief description of the meaning of each flag:
CWR: Congestion Window Reduced flag. Set by an ECN-Capable sender when it reduces its congestion window (due to a retransmit timeout, a Fast Retransmit or in response to an ECN Notification).
ECN: During the three-way handshake it indicates that sender is capable of performing explicit congestion notification. Normally it means that a packet with the IP Congestion Experienced flag set was received during normal transmission. See RFC 3168 for more information.
URG: (Urgent) Segment is urgent and the Urgent Pointer field carries valid information.
ACK: (Acknowledgement) The segment carries an acknowledgement and the value of the Acknowledgement Number field is valid and contains the next sequence number that is expected from the receiver.
PSH: (Push) The data in this segment should be immediately pushed to the application layer on arrival.
RST: (Reset) There was some problem and the sender wants to abort the connection.
SYN: (Synchronize) The segment is a request to synchronize sequence numbers and establish a connection. The Sequence Number field contains the sender's Initial Sequence Number.
FIN: (Finish) The sender wants to close the connection.
--win size (Window Size) .
--badsum (Invalid Checksum) .
-g portnumber; --source-port portnumber (Spoof source port) .
-p port_spec; --dest-port port_spec (Target ports) .
--badsum (Invalid Checksum) .
--icmp-type type (ICMP Type) .
In general you can use the full option name (e.g destination-unreachable), the 4-3 letters format (e.g. dest-unr) or the initials (e.g. du). In ICMP types that request something, the word "request" is omitted. These are the the available ICMP types:
destination-unreachable; dest-unr; du; Send Destination Unreachable messages. This message indicates that a datagram could not be delivered to its destination.
source-quench; sour-que; sq; Send Source Quench messages. This message is used by a congested IP device to tell other device that is sending packets too fast and that it should slow down.
redirect; redi; r; Send Redirect messages. This message is normally used by routers to inform a host that there is a better route to use for sending datagrams.
echo-request; echo; e; Send Echo Request messages. This message is used to test the connectivity of another device on a network.
echo-reply; echo-rep; er; Send ICMP echo replies. Send Echo Reply messages. This message is sent in response to an Echo Request message.
router-advertisement; rout-adv; ra; Send Router Advertisement messages. This message is used by routers to let hosts know of their existence and capabilities.
router-solicitation; rout-sol; rs; Send Router Solicitation messages. This message is used by hosts to request Router Advertisement messages from any listening routers.
time-exceeded; time-exc; te; Send Time Exceeded messages. This message is generated by some intermediate device (normally a router) to indicate that a datagram has been discarded before reaching its destination because the IP Time To Live expired.
parameter-problem; para-pro; pp; Send Parameter Problem messages. This message is used when a device finds a problem with a parameter in an IP header and it cannot continue processing it.
timestamp; time; tm; Send Timestamp Request messages. This message is used to request a device to send a timestamp value for propagation time calculation and clock synchronization.
timestamp-reply; time-rep; tr; Send Timestamp Reply messages. This message is sent in response to a Timestamp Request message.
information; info; i; Send Information Request messages. This message is now obsolete but it was originally used to request configuration information from another device.
information-reply; info-rep; ir; Send Information Reply messages. This message is now obsolete but it was originally sent in response to an Information Request message to provide configuration information.
mask-request; mask; m; Send Address Mask Request messages. This message is used to ask a device to send its subnet mask.
mask-reply; mask-rep; mr; Send Address Mask Reply messages. This message contains a subnet mask and is sent in response to a Address Mask Request message.
traceroute; trace; tc; Send Traceroute messages. This message is normally sent by an intermediate device when it receives an IP datagram with a traceroute option. ICMP Traceroute messages are still experimental, see RFC 1393 for more information.
--icmp-code code (ICMP Code) .
CODES FOR DESTINATION UNREACHABLE MESSAGES:
network-unreachable; netw-unr; net; Datagram could not be delivered to its destination network (probably due to some routing problem).
host-unreachable; host-unr; host; Datagram was delivered to the destination network but it was impossible to reach the specified host (probably due to some routing problem).
protocol-unreachable; prot-unr; proto; The protocol specified in the Protocol field of the IP datagram is not supported by the host to which the datagram was delivered.
port-unreachable; port-unr; port; The TCP/UDP destination port was invalid.
needs-fragmentation; need-fra; frag; Datagram had the DF bit set but it was too large for the MTU of the next physical network so it had to be dropped.
source-route-failed; sour-rou; routefail; IP datagram had a Source Route option but a router couldn't pass it to the next hop.
network-unknown; netw-unk; net?; Destination network is unknown. This code is never used. Instead, Network Unreachable is used.
host-unknown; host-unk; host?; Specified host is unknown. Usually generated by a router local to the destination host to inform of a bad address.
host-isolated; host-iso; isolated; Source Host Isolated. Not used.
network-prohibited; netw-pro; !net; Communication with destination network is administratively prohibited (source device is not allowed to send packets to the destination network)
host-prohibited; host-pro; !host; Communication with destination host is administratively prohibited (source device is allowed to send packets to the destination network but not to the destination device)
network-tos; unreachable-network-tos; netw-tos; tosnet; Destination network unreachable because it cannot provide the type of service specified in the IP TOS field.
host-tos; unreachable-host-tos; toshost; Destination host unreachable because it cannot provide the type of service specified in the IP TOS field.
communication-prohibited; comm-pro; !comm; Datagram could not be forwarded due to filtering that blocks the message based on its contents
host-precedence-violation; precedence-violation; prec-vio; violation; Precedence value in the IP TOS field is not permited.
precedence-cutoff; prec-cut; cutoff; Precedence value in the IP TOS field is lower than the minimum allowed for the network.
CODES FOR REDIRECT MESSAGES:
redirect-network; redi-net; net; Redirect all future datagrams with the same destination network as the original datagram, to the router specified in the Address field. The use of this code is prohibited by RFC 1812.
redirect-host; redi-host; host; Redirect all future datagrams with the same destination host as the original datagram, to the router specified in the Address field.
redirect-network-tos; redi-ntos; redir-ntos; Redirect all future datagrams with the same destination network and IP TOS value as the original datagram, to the router specified in the Address field. The use of this code is prohibited by RFC 1812.
redirect-host-tos; redi-htos; redir-htos; Redirect all future datagrams with the same destination host and IP TOS value as the original datagram, to the router specified in the Address field.
CODES FOR ROUTER ADVERTISEMENT MESSAGES:
normal-advertisement; norm-adv; normal; zero; default; def; Normal router advertisement. In Mobile IP: Mobility agent can act as a router for IP datagrams not related to mobile nodes.
not-route-common-traffic; not-rou; mobile-ip; !route; !commontraffic; Used for Mobile IP. The mobility agent does not route common traffic. All foreign agents must forward to a default router any datagrams received from a registered mobile node
CODES FOR TIME EXCEEDED MESSAGES:
ttl-exceeded-in-transit; ttl-exc; ttl-transit; IP Time To Live expired during transit.
fragment-reassembly-time-exceeded; frag-exc; frag-time; Fragment reassemly time has been exceeded.
CODES FOR PARAMETER PROBLEM MESSAGES:
pointer-indicates-error; poin-ind; pointer; The pointer field indicates the location of the problem.
missing-required-option; miss-option; option-missing; IP datagram was expected to have an option that is not present.
bad-length; bad-len; badlen; The length of the IP datagram is incorrect.
--icmp-id id (ICMP Identifier) .
--icmp-seq seq (ICMP Sequence) .
--icmp-redirect-addr addr (ICMP Redirect Address) .
--icmp-param-pointer pointer (ICMP Parameter Problem Pointer) .
--icmp-advert-lifetime ttl (ICMP Router Advertisement Lifetime) .
--icmp-advert-entry addr,pref (ICMP Router Advertisement Entry) .
--icmp-orig-time timestamp (ICMP Originate Timestamp) .
--icmp-recv-time timestamp (ICMP Receive Timestamp) .
--icmp-trans-time timestamp (ICMP Transmit Timestamp) .
--arp-type type (ICMP Type) .
arp-request; arp; a; Send ARP requests. ARP requests are used to translate network layer addresses (normally IP addresses) to link layer addresses (usually MAC addresses). Basically, and ARP request is a broadcasted message that asks the host in the same network segment that has a given IP address to provide its MAC address.
arp-reply; arp-rep; ar; Send ARP replies. An ARP reply is a message that a host sends in response to an ARP request to provide its link layer address.
rarp-request; rarp; r; Send RARP requests. RARP requests are used to translate a link layer address (normally a MAC address) to a network layer address (usually an IP address). Basically a RARP request is a broadcasted message sent by a host that wants to know his own IP address because it doesn't have any. It was the first protocol designed to solve the bootstrapping problem. However, RARP is now obsolete and DHCP is used instead. For more information about RARP see RFC 903.
rarp-reply; rarp-rep; rr; Send RARP replies. A RARP reply is a message sent in response to a RARP request to provide an IP address to the host that sent the RARP request in the first place.
drarp-request; drarp; d; Send Dynamic RARP requests. Dynamic RARP is an extension to RARP used to obtain or assign a network layer address from a fixed link layer address. DRARP was used mainly in Sun Microsystems platforms in the late 90's but now it's no longer used. See RFC 1931 for more information.
drarp-reply; drarp-rep; dr; Send Dynamic RARP replies. A DRARP reply is a message sent in response to a RARP request to provide network layer address.
drarp-error; drarp-err; de; Send RARP error replies. DRARP Error messages are usually sent in response to DRARP requests to inform of some error. In DRARP Error messages, the Target Protocol Address field is used to carry an error code (usually in the first byte). The error code is intended to tell why no target protocol address is being returned. For more information see RFC 1931.
inarp-request; inarp; i; Send Inverse ARP requests. InARP requests are used to translate a link layer address to a network layer address. It is similar to RARP request but in this case, the sender of the InARP request wants to know the network layer address of another node, not its own address. InARP is mainly used in Frame Relay and ATM networks. For more information see RFC 2390
inarp-reply; inarp-rep; ir; Send Inverse ARP replies. InARP replies are messages sent in response to InARP requests to provide the network layer address associated with the host that has a given link layer address.
arp-nak; an; Send ARP NAK messages. ARP NAK messages are an extension to the ATMARP protocol and they are used to improve the robustness of the ATMARP server mechanism. With ARP NAK, a client can determine the difference between a catastrophic server failure and an ATMARP table lookup failure. See RFC 1577 for more information.
--arp-sender-mac mac (Sender MAC address) .
--arp-sender-ip addr (Sender IP address) .
--arp-target-mac mac (target MAC address) .
--arp-target-ip addr (target ip address) .
-S addr; --source-ip addr (Source IP Address) .
--dest-ip addr (Destination IP Address) .
--tos tos (Type of Service) .
--id id (Identification) .
--df (Don't Fragment) .
--md (More Fragments) .
--ttl hops (Time To Live) .
--badsum-ip (Invalid IP checksum) .
--ip-options S|R [route]|L [route]|T|U ...; --ip-options hex string (IP Options) .
--mtu size (Maximum Transmission Unit) .
-6 ; --IPv6 (Use IPv6) .
While IPv6 hasn't exactly taken the world by storm, it gets significant use in some (usually Asian) countries and most modern operating systems support it. To use Nping with IPv6, both the source and target of your packets must be configured for IPv6. If your ISP (like most of them) does not allocate IPv6 addresses to you, free tunnel brokers are widely available and work fine with Nping. You can use the free IPv6 tunnel broker service at http://www.tunnelbroker.net.
Please note that IPv6 support is still highly experimental and many modes and options may not with with it.
-S addr; --source-ip addr (Source IP Address) .
--dest-ip addr (Destination IP Address) .
--flow label (Flow Label) .
--traffic-class class (Traffic Class) .
--hop-limit hops (Hop Limit) .
In most cases Nping sends packets at raw IP level. This means that Nping creates its own IP packets and transmits them through a raw socket. However, in some cases it may be necessary to send packets at the raw Ethernet level. This happens, for example, when Nping is run under Windows (as Microsoft has disabled raw socket support since Windows XP SP2), or when Nping is asked to send ARP packets. Since in some cases it is necessary to construct ethernet frames, Nping offers some options to manipulate the different fields.
--dest-mac mac (Ethernet Destination MAC Address) .
--source-mac mac (Ethernet Source MAC Address) .
--ether-type type (EtherType) .
ipv4; ip; 4; Internet Protocol version 4.
ipv6; 6; Internet Protocol version 6.
arp; Address Resolution Protocol.
rarp; Reverse Address Resolution Protocol.
frame-relay; frelay; fr; Frame Relay
pptp; Point-to-Point Protocol.
gsmp; General Switch Management Protocol.
mpls; Multiprotocol Label Switching.
mps-ual; mps; Multiprotocol Label Switching with Upstream-assigned Label.
mcap; Multicast Channel Allocation Protocol.
pppoe-discovery; pppoe-d; PPP over Ethernet Discovery Stage.
pppoe-session; pppoe-s; PP over Ethernet Session Stage.
ctag; Customer VLAN Tag Type.
epon; Ethernet Passive Optical Network.
pbnac; Port-based network access control.
stag; Service VLAN tag identifier.
ethexp1; Local Experimental Ethertype 1.
ethexp2; Local Experimental Ethertype 2.
ethoui; OUI Extended Ethertype.
preauth; Pre-Authentication.
lldp; Link Layer Discovery Protocol.
mac-security; mac-sec; macsec; Media Access Control Security.
mvrp; Multiple VLAN Registration Protocol.
mmrp; Multiple Multicast Registration Protocol.
frrr; Fast Roaming Remote Request.
Description.
--data hex string (Append custom binary data to sent packets) .
--data-string string (Append custom ASCII string to sent packets) .
--data-length len (Append random data to sent packets) .
--delay time (Delay between probes) .
--rate rate (Send probes at a given rate) .
-h ; --help (Display help) .
-V ; --version (Display current version) .
-c rounds; --count rounds (Stop after a given number of rounds) .
-e name; --interface name (Set the network interface to be used) .
--privileged (Assume that the user is fully privileged) .
--unprivileged (Assume that the user lacks raw socket privileges) .
--send-eth (Use raw ethernet sending) .
--send-ip (Send at raw IP level) .
--bpf-filter filter spec --filter filter spec (Set custom BPF filter) .
-H ; --hide-sent (Do not display sent packets) .
-N ; --no-capture (Do not attempt to capture replies) .
Description.
-v[level] (Increase or set verbosity level) . .
Level -4: No output at all. In some circumstances you may not want Nping to produce any output (like when one of your work mates is watching over your shoulder). In that case level 0 can be useful because although you won't see any response packets, probes will still be sent.
Level -3: Like level -4 but displaying fatal error messages so you can actually see if Nping is running or it failed due to some error.
Level -2: Like level -3 but also displaying warnings and recoverable errors.
Level -1: Displays traditional run-time information (version, start time, statisctics, etc) but does not display sent/received packets.
Level 0: This is the default verbosity level. It behaves like level -1 but displaying sent/receive packets and some other important information.
Level 1: Like level 0 but it displays detailed information about timing, flags, protocol details, etc.
Level 2: Like level 1 but displaying very detailed information about sent/recv packets and other interesting information.
Level 3: Like level 2 but also displaying the raw hexadecimal dump of sent and received packets.
Level 4: Currently unused.
-q[level] (Decrease verbosity level) . .
-d[level] (Increase or set debugging level) .
Debugging output is useful when a bug is suspected in Nping, or if you are simply confused as to what Nping is doing and why. As this feature is mostly intended for developers, debug lines aren't always self-explanatory. You may get something like: "NSOCK (1.0000s) Callback: TIMER SUCCESS for EID 12; tcpconnect_event_handler(): Received callback of type TIMER with status SUCCESS". If you don't understand a line, your only recourses are to ignore it, look it up in the source code, or request help from the development list (nmap-dev).. Some lines are self explanatory, but the messages become more obscure as the debug level is increased.
These are the available levels:
Level 0: Level 0. No debug information at all. This is the default level.
Level 1: In this level, only very important or high level debug information will be printed.
Level 2: Like level 1 but also displaying important or medium level debug information
Level 3: Like level 2 but it displays regular and low level debug information.
Level 4: Like level 3 but displaying messages only a real Nping freak would want to see.
Level 5: Like level 4 but it enables basic debug information related to external libraries like nsock.
Level 6: Like level 5 but it enables full, very detailed, debug information related to external libraries like nsock.
Like its author, Nping isn't perfect. But you can help make it better by sending bug reports or even writing patches. If Nping doesn't behave the way you expect, first upgrade to the latest version available from m[blue]http://nmap.org/npingm[]. If the problem persists, do some research to determine whether it has already been discovered and addressed. Try searching for the error message on our search page at m[blue]http://insecure.org/search.htmlm[] or at Google. Also try browsing the nmap-dev archives at m[blue]http://seclists.org/m[].Read this full manual page as well. If nothing comes of this, mail a bug report to nmap-dev@insecure.org. Please include everything you have learned about the problem, as well as what version of Nping you are running and what operating system version it is running on. Problem reports and Nping usage questions sent to nmap-dev@insecure.org are far more likely to be answered than those sent to Fyodor directly. If you subscribe to the nmap-dev list before posting, your message will bypass moderation and get through more quickly. Subscribe at m[blue]http://cgi.insecure.org/mailman/listinfo/nmap-devm[].
Code patches to fix bugs are even better than bug reports. Basic instructions for creating patch files with your changes are available at m[blue]http://nmap.org/data/HACKINGm[]. Patches may be sent to nmap-dev (recommended) or to any of the authors listed in the next section directly.
Luis MartinGarcia luis.mgarc@gmail.com (m[blue]http://aldabaknocking.comm[])
Fyodor fyodor@insecure.org (m[blue]http://insecure.orgm[])