> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/active-reconnaissance-approach/netwrok-scanning-tools/nping.md).

# nping

`nping` is a network packet generator, ping tool, and response analysis utility included with the Nmap suite. It helps users to send custom ICMP, TCP, UDP, and ARP packets.

### Syntax

```bash
nping [options] [targets...]
```

### Examples

#### **Basic Usage**

* **Ping a host using ICMP (like traditional `ping`)**

  ```bash
  nping --icmp 192.168.1.1
  ```
* **Send a specific number of ICMP echo requests**

  ```bash
  nping --icmp -c 5 192.168.1.1
  ```
* **Increase packet sending rate (e.g., 10 packets per second)**

  ```bash
  nping --icmp --rate 10 192.168.1.1
  ```
* **Send an ICMP packet with a custom payload**

  ```bash
  nping --icmp --data-string "Testing Nping" 192.168.1.1
  ```

***

#### **TCP Probing**

* **Perform a TCP SYN scan on port 80**

  ```bash
  nping --tcp -p 80 192.168.1.1
  ```
* **Send a TCP SYN packet from a custom source port**

  ```bash
  nping --tcp -p 443 -g 12345 192.168.1.1
  ```
* **Send a TCP ACK packet to test for filtering**

  ```bash
  nping --tcp --ack -p 80 192.168.1.1
  ```
* **Send a TCP packet with custom flags (e.g., SYN and PSH)**

  ```bash
  nping --tcp --flags SYN,PSH -p 80 192.168.1.1
  ```
* **Send a TCP packet with a specific sequence number**

  ```bash
  nping --tcp -p 80 --seq 123456 192.168.1.1
  ```
* **Send a TCP packet with a random invalid checksum**

  ```bash
  nping --tcp -p 80 --badsum 192.168.1.1
  ```

***

#### **UDP Probing**

* **Send a UDP packet to port 53**

  ```bash
  nping --udp -p 53 192.168.1.1
  ```
* **Send multiple UDP packets at a higher rate**

  ```bash
  nping --udp --rate 100 -p 53 192.168.1.1
  ```
* **Send a UDP packet with a specific payload**

  ```bash
  nping --udp --data-string "Custom Data" -p 161 192.168.1.1
  ```

***

#### **ARP Scanning**

* **Send an ARP request to discover live hosts in a subnet**

  ```bash
  nping --arp-scan 192.168.1.0/24
  ```
* **Send an ARP request to find the MAC address of a specific IP**

  ```bash
  nping --arp 192.168.1.1
  ```
* **Spoof an ARP request with a custom MAC address**

  ```bash
  nping --arp --arp-sender-mac 00:11:22:33:44:55 --arp-sender-ip 192.168.1.100 192.168.1.1
  ```

***

#### **Traceroute Mode**

* **Perform a TCP-based traceroute to port 80**

  ```bash
  nping --tcp-traceroute -p 80 192.168.1.1
  ```
* **Perform an ICMP-based traceroute**

  ```bash
  nping --traceroute --icmp 192.168.1.1
  ```

***

#### **IPv4 and IPv6 Options**

* **Set a custom source IP address**

  ```bash
  nping --tcp -p 80 --source-ip 192.168.1.100 192.168.1.1
  ```
* **Set a custom TTL value**

  ```bash
  nping --tcp -p 80 --ttl 5 192.168.1.1
  ```
* **Use an invalid IP checksum**

  ```bash
  nping --tcp -p 80 --badsum-ip 192.168.1.1
  ```
* **Send packets over IPv6**

  ```bash
  nping --tcp -p 443 --IPv6 2607:f8b0:4005:809::200e
  ```

***

#### **Ethernet Options**

* **Specify a custom source MAC address**

  ```bash
  nping --tcp -p 22 --source-mac 00:11:22:33:44:55 192.168.1.1
  ```
* **Specify a custom destination MAC address**

  ```bash
  nping --tcp -p 22 --dest-mac aa:bb:cc:dd:ee:ff 192.168.1.1
  ```

***

#### **Timing & Output Control**

* **Send packets at a specific rate (e.g., 50 packets per second)**

  ```bash
  nping --tcp -p 80 --rate 50 192.168.1.1
  ```
* **Add a delay between packets (e.g., 500ms)**

  ```bash
  nping --tcp -p 80 --delay 500ms 192.168.1.1
  ```
* **Run in quiet mode (minimal output)**

  ```bash
  nping --tcp -p 80 --quiet 192.168.1.1
  ```
* **Enable verbose mode for detailed output**

  ```bash
  nping --tcp -p 80 --verbose 192.168.1.1
  ```
* **Increase debugging level for troubleshooting**

  ```bash
  nping --tcp -p 80 -d3 192.168.1.1
  ```

***

#### **ECHO Mode (Network Latency & Path Testing)**

* **Run `nping` in echo server mode (listens for connections on a specific port)**

  ```bash
  nping --echo-server mySecretPassphrase
  ```
* **Run `nping` in echo client mode (connects to an echo server)**

  ```bash
  nping --echo-client mySecretPassphrase 192.168.1.1
  ```

***

#### **Firewall Evasion & Customization**

* **Spoof source IP address and MAC address**

  ```bash
  nping --tcp -p 80 --source-ip 192.168.1.100 --source-mac 00:11:22:33:44:55 192.168.1.1
  ```
* **Modify the Type of Service (ToS) field**

  ```bash
  nping --tcp -p 80 --tos 16 192.168.1.1
  ```
* **Fragment packets to bypass firewall rules**

  ```bash
  nping --tcp -p 80 --mtu 68 192.168.1.1
  ```