> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/active-reconnaissance-approach/netwrok-scanning-tools/hping3.md).

# hping3

`hping3` is a network tool that generates and transmits custom ICMP, UDP, and TCP packets while displaying target responses. It supports packet fragmentation, arbitrary payloads, and adjustable packet size. The tool enables network analysis, firewall rule evaluation, port scanning (including spoofed scans), path MTU discovery, TCP/IP stack auditing etc. 

### Syntax

```bash
hping3 [options] host
```

### Examples

#### Basic Usage

* **Check if a host is alive (ICMP Ping)**

  ```bash
  hping3 -1 192.168.1.1
  ```
* **Send a specific number of packets (e.g., 5 pings)**

  ```bash
  hping3 -1 -c 5 192.168.1.1
  ```
* **Send packets as fast as possible (flood mode)**

  ```bash
  hping3 --flood -1 192.168.1.1
  ```

#### TCP Scanning & Probing

* **Send a TCP SYN packet to check if a port is open**

  ```bash
  hping3 -S -p 80 192.168.1.1
  ```
* **Perform a TCP connect scan on multiple ports**

  ```bash
  hping3 --scan 20-100 -S 192.168.1.1
  ```
* **Send TCP packets with ACK flag set (firewall detection)**

  ```bash
  hping3 -A -p 80 192.168.1.1
  ```
* **Send TCP packets with FIN flag set (stealth scan)**

  ```bash
  hping3 -F -p 80 192.168.1.1
  ```
* **Send an Xmas scan (FIN, URG, and PSH flags set)**

  ```bash
  hping3 -X -p 80 192.168.1.1
  ```

#### UDP Scanning

* **Send a UDP packet to a specific port**

  ```bash
  hping3 -2 -p 53 192.168.1.1
  ```
* **Send a large UDP packet to test for fragmentation**

  ```bash
  hping3 -2 -p 53 --frag -d 1000 192.168.1.1
  ```

#### Advanced Packet Manipulation

* **Spoof source IP address**

  ```bash
  hping3 -S -p 80 -a 192.168.1.100 192.168.1.1
  ```
* **Set a custom TTL value**

  ```bash
  hping3 -S -p 80 -t 5 192.168.1.1
  ```
* **Send fragmented packets**

  ```bash
  hping3 -S -p 80 --frag 192.168.1.1
  ```

#### Traceroute Mode

* **Perform a traceroute to a target**

  ```bash
  hping3 -T -S -p 80 192.168.1.1
  ```

#### Output Control

* **Run hping3 in quiet mode (suppress per-packet output)**

  ```bash
  hping3 -q -1 192.168.1.1
  ```
* **Enable verbose mode for detailed output**

  ```bash
  hping3 -V -S -p 80 192.168.1.1
  ```