NAME¶

nping - Network packet generation tool / ping utility

SYNOPSIS¶

nping [Options] {targets}

DESCRIPTION¶

Nping is an open-source tool for network packet generation, response analysis and response time measurement. Nping allows users to generate network packets of a wide range of protocols, letting them tune virtually any field of the protocol headers. While Nping can be used as a simple ping utility to detect active hosts, it can also be used as a raw packet generator for network stack stress tests, ARP poisoning, Denial of Service attacks, route tracing, and other purposes.

Additionally, Nping offers a special mode of operation called the "Echo Mode", that lets users see how the generated probes change in transit, revealing the differences between the transmitted packets and the packets received at the other end. See section "Echo Mode" for details.

The output from Nping is a list of the packets that are being sent and received. The level of detail depends on the options used.

A typical Nping execution is shown in Example 1. The only Nping arguments used in this example are -c, to specify the number of times to target each host, --tcp to specify TCP Probe Mode, -p 80,433 to specify the target ports; and then the two target hostnames.

Example 1. A representative Nping execution

# nping -c 1 --tcp -p 80,433 scanme.nmap.org google.com
Starting Nping ( http://nmap.org/nping )
SENT (0.0120s) TCP 96.16.226.135:50091 > 64.13.134.52:80 S ttl=64 id=52072 iplen=40  seq=1077657388 win=1480 
RCVD (0.1810s) TCP 64.13.134.52:80 > 96.16.226.135:50091 SA ttl=53 id=0 iplen=44  seq=4158134847 win=5840 <mss 1460>
SENT (1.0140s) TCP 96.16.226.135:50091 > 74.125.45.100:80 S ttl=64 id=13932 iplen=40  seq=1077657388 win=1480 
RCVD (1.1370s) TCP 74.125.45.100:80 > 96.16.226.135:50091 SA ttl=52 id=52913 iplen=44  seq=2650443864 win=5720 <mss 1430>
SENT (2.0140s) TCP 96.16.226.135:50091 > 64.13.134.52:433 S ttl=64 id=8373 iplen=40  seq=1077657388 win=1480 
SENT (3.0140s) TCP 96.16.226.135:50091 > 74.125.45.100:433 S ttl=64 id=23624 iplen=40  seq=1077657388 win=1480 
Statistics for host scanme.nmap.org (64.13.134.52):


 |  Probes Sent: 2 | Rcvd: 1 | Lost: 1  (50.00%)


 |_ Max rtt: 169.720ms | Min rtt: 169.720ms | Avg rtt: 169.720ms
Statistics for host google.com (74.125.45.100):


 |  Probes Sent: 2 | Rcvd: 1 | Lost: 1  (50.00%)


 |_ Max rtt: 122.686ms | Min rtt: 122.686ms | Avg rtt: 122.686ms
Raw packets sent: 4 (160B) | Rcvd: 2 (92B) | Lost: 2 (50.00%)
Tx time: 3.00296s | Tx bytes/s: 53.28 | Tx pkts/s: 1.33
Rx time: 3.00296s | Rx bytes/s: 30.64 | Rx pkts/s: 0.67
Nping done: 2 IP addresses pinged in 4.01 seconds

OPTIONS SUMMARY¶

This options summary is printed when Nping is run with no arguments. It helps people remember the most common options, but is no substitute for the in-depth documentation in the rest of this manual. Some obscure options aren't even included here.

Nping 0.5.59BETA1 ( http://nmap.org/nping )
Usage: nping [Probe mode] [Options] {target specification}
TARGET SPECIFICATION:


  Targets may be specified as hostnames, IP addresses, networks, etc.


  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
PROBE MODES:


  --tcp-connect                    : Unprivileged TCP connect probe mode.


  --tcp                            : TCP probe mode.


  --udp                            : UDP probe mode.


  --icmp                           : ICMP probe mode.


  --arp                            : ARP/RARP probe mode.


  --tr, --traceroute               : Traceroute mode (can only be used with 


                                     TCP/UDP/ICMP modes).
TCP CONNECT MODE:


   -p, --dest-port <port spec>     : Set destination port(s).


   -g, --source-port <portnumber>  : Try to use a custom source port.
TCP PROBE MODE:


   -g, --source-port <portnumber>  : Set source port.


   -p, --dest-port <port spec>     : Set destination port(s).


   --seq <seqnumber>               : Set sequence number.


   --flags <flag list>             : Set TCP flags (ACK,PSH,RST,SYN,FIN...)


   --ack <acknumber>               : Set ACK number.


   --win <size>                    : Set window size.


   --badsum                        : Use a random invalid checksum. 
UDP PROBE MODE:


   -g, --source-port <portnumber>  : Set source port.


   -p, --dest-port <port spec>     : Set destination port(s).


   --badsum                        : Use a random invalid checksum. 
ICMP PROBE MODE:


  --icmp-type <type>               : ICMP type.


  --icmp-code <code>               : ICMP code.


  --icmp-id <id>                   : Set identifier.


  --icmp-seq <n>                   : Set sequence number.


  --icmp-redirect-addr <addr>      : Set redirect address.


  --icmp-param-pointer <pnt>       : Set parameter problem pointer.


  --icmp-advert-lifetime <time>    : Set router advertisement lifetime.


  --icmp-advert-entry <IP,pref>    : Add router advertisement entry.


  --icmp-orig-time  <timestamp>    : Set originate timestamp.


  --icmp-recv-time  <timestamp>    : Set receive timestamp.


  --icmp-trans-time <timestamp>    : Set transmit timestamp.
ARP/RARP PROBE MODE:


  --arp-type <type>                : Type: ARP, ARP-reply, RARP, RARP-reply.


  --arp-sender-mac <mac>           : Set sender MAC address.


  --arp-sender-ip  <addr>          : Set sender IP address.


  --arp-target-mac <mac>           : Set target MAC address.


  --arp-target-ip  <addr>          : Set target IP address.
IPv4 OPTIONS:


  -S, --source-ip                  : Set source IP address.


  --dest-ip <addr>                 : Set destination IP address (used as an 


                                     alternative to {target specification} ). 


  --tos <tos>                      : Set type of service field (8bits).


  --id  <id>                       : Set identification field (16 bits).


  --df                             : Set Don't Fragment flag.


  --mf                             : Set More Fragments flag.


  --ttl <hops>                     : Set time to live [0-255].


  --badsum-ip                      : Use a random invalid checksum. 


  --ip-options <S|R [route]|L [route]|T|U ...> : Set IP options


  --ip-options <hex string>                    : Set IP options


  --mtu <size>                     : Set MTU. Packets get fragmented if MTU is


                                     small enough.
IPv6 OPTIONS:


  -6, --IPv6                       : Use IP version 6.


  --dest-ip                        : Set destination IP address (used as an


                                     alternative to {target specification}).


  --hop-limit                      : Set hop limit (same as IPv4 TTL).


  --traffic-class <class> :        : Set traffic class.


  --flow <label>                   : Set flow label.
ETHERNET OPTIONS:


  --dest-mac <mac>                 : Set destination mac address. (Disables


                                     ARP resolution)


  --source-mac <mac>               : Set source MAC address.


  --ether-type <type>              : Set EtherType value.
PAYLOAD OPTIONS:


  --data <hex string>              : Include a custom payload.


  --data-string <text>             : Include a custom ASCII text.


  --data-length <len>              : Include len random bytes as payload.
ECHO CLIENT/SERVER:


  --echo-client <passphrase>       : Run Nping in client mode.


  --echo-server <passphrase>       : Run Nping in server mode.


  --echo-port <port>               : Use custom <port> to listen or connect.


  --no-crypto                      : Disable encryption and authentication.


  --once                           : Stop the server after one connection.


  --safe-payloads                  : Erase application data in echoed packets.
TIMING AND PERFORMANCE:


  Options which take <time> are in seconds, or append 'ms' (milliseconds),


  's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m, 0.25h).


  --delay <time>                   : Adjust delay between probes.


  --rate  <rate>                   : Send num packets per second.
MISC:


  -h, --help                       : Display help information.


  -V, --version                    : Display current version number. 


  -c, --count <n>                  : Stop after <n> rounds.


  -e, --interface <name>           : Use supplied network interface.


  -H, --hide-sent                  : Do not display sent packets.


  -N, --no-capture                 : Do not try to capture replies.


  --privileged                     : Assume user is fully privileged.


  --unprivileged                   : Assume user lacks raw socket privileges.


  --send-eth                       : Send packets at the raw ethernet layer.


  --send-ip                        : Send packets using raw IP sockets.


  --bpf-filter <filter spec>       : Specify custom BPF filter.
OUTPUT:


  -v                               : Increment verbosity level by one.


  -v[level]                        : Set verbosity level. E.g: -v4


  -d                               : Increment debugging level by one.


  -d[level]                        : Set debugging level. E.g: -d3


  -q                               : Decrease verbosity level by one.


  -q[N]                            : Decrease verbosity level N times


  --quiet                          : Set verbosity and debug level to minimum.


  --debug                          : Set verbosity and debug to the max level.
EXAMPLES:


  nping scanme.nmap.org


  nping --tcp -p 80 --flags rst --ttl 2 192.168.1.1


  nping --icmp --icmp-type time --delay 500ms 192.168.254.254


  nping --echo-server "public" -e wlan0 -vvv 


  nping --echo-client "public" echo.nmap.org --tcp -p1-1024 --flags ack
SEE THE MAN PAGE FOR MANY MORE OPTIONS, DESCRIPTIONS, AND EXAMPLES

TARGET SPECIFICATION¶

Everything on the Nping command line that isn't an option or an option argument is treated as a target host specification. Nping uses the same syntax for target specifications that Nmap does. The simplest case is a single target given by IP address or hostname.

Nping supports CIDR-style. addressing. You can append /numbits to an IPv4 address or hostname and Nping will send probes to every IP address for which the first numbits are the same as for the reference IP or hostname given. For example, 192.168.10.0/24 would send probes to the 256 hosts between 192.168.10.0 (binary: 11000000 10101000 00001010 00000000) and 192.168.10.255 (binary: 11000000 10101000 00001010 11111111), inclusive. 192.168.10.40/24 would ping exactly the same targets. Given that the host scanme.nmap.org. is at the IP address 64.13.134.52, the specification scanme.nmap.org/16 would send probes to the 65,536 IP addresses between 64.13.0.0 and 64.13.255.255. The smallest allowed value is /0, which targets the whole Internet. The largest value is /32, which targets just the named host or IP address because all address bits are fixed.

CIDR notation is short but not always flexible enough. For example, you might want to send probes to 192.168.0.0/16 but skip any IPs ending with .0 or .255 because they may be used as subnet network and broadcast addresses. Nping supports this through octet range addressing. Rather than specify a normal IP address, you can specify a comma-separated list of numbers or ranges for each octet. For example, 192.168.0-255.1-254 will skip all addresses in the range that end in .0 or .255, and 192.168.3-5,7.1 will target the four addresses 192.168.3.1, 192.168.4.1, 192.168.5.1, and 192.168.7.1. Either side of a range may be omitted; the default values are 0 on the left and 255 on the right. Using - by itself is the same as 0-255, but remember to use 0- in the first octet so the target specification doesn't look like a command-line option. Ranges need not be limited to the final octets: the specifier 0-.-.13.37 will send probes to all IP addresses on the Internet ending in .13.37. This sort of broad sampling can be useful for Internet surveys and research.

IPv6 addresses can only be specified by their fully qualified IPv6 address or hostname. CIDR and octet ranges aren't supported for IPv6 because they are rarely useful.

Nping accepts multiple host specifications on the command line, and they don't need to be the same type. The command nping scanme.nmap.org 192.168.0.0/8 10.0.0,1,3-7.- does what you would expect.

OPTION SPECIFICATION¶

Nping is designed to be very flexible and fit a wide variety of needs. As with most command-line tools, its behavior can be adjusted using command-line options. These general principles apply to option arguments, unless stated otherwise.

Options that take integer numbers can accept values specified in decimal, octal or hexadecimal base. When a number starts with 0x, it will be treated as hexadecimal; when it simply starts with 0, it will be treated as octal. Otherwise, Nping will assume the number has been specified in base 10. Virtually all numbers that can be supplied from the command line are unsigned so, as a general rule, the minimum value is zero. Users may also specify the word random or rand to make Nping generate a random value within the expected range.

IP addresses may be given as IPv4 addresses (e.g. 192.168.1.1), IPv6 addresses (e.g. 2001:db8:85a3::8e4c:760:7146), or hostnames, which will be resolved using the default DNS server configured in the host system.

Options that take MAC addresses accept the usual colon-separated 6 hex byte format (e.g. 00:50:56:d4:01:98). Hyphens may also be used instead of colons (e.g. 00-50-56-c0-00-08). The special word random or rand sets a random address and the word broadcast or bcast sets ff:ff:ff:ff:ff:ff.

GENERAL OPERATION¶

Unlike other ping and packet generation tools, Nping supports multiple target host and port specifications. While this provides great flexibility, it is not obvious how Nping handles situations where there is more than one host and/or more than one port to send probes to. This section explains how Nping behaves in these cases.

When multiple target hosts are specified, Nping rotates among them in round-robin fashion. This gives slow hosts more time to send their responses before another probe is sent to them. Ports are also scheduled using round robin. So, unless only one port is specified, Nping never sends two probes to the same target host and port consecutively.

The loop around targets is the “inner loop” and the loop around ports is the “outer loop”. All targets will be sent a probe for a given port before moving on to the next port. Between probes, Nping waits a configurable amount of time called the “inter-probe delay”, which is controlled by the --delay option. These examples show how it works.

# nping --tcp -c 2 1.1.1.1 -p 100-102
Starting Nping ( http://nmap.org/nping )
SENT (0.0210s) TCP 192.168.1.77 > 1.1.1.1:100
SENT (1.0230s) TCP 192.168.1.77 > 1.1.1.1:101
SENT (2.0250s) TCP 192.168.1.77 > 1.1.1.1:102
SENT (3.0280s) TCP 192.168.1.77 > 1.1.1.1:100
SENT (4.0300s) TCP 192.168.1.77 > 1.1.1.1:101
SENT (5.0320s) TCP 192.168.1.77 > 1.1.1.1:102

# nping --tcp -c 2 1.1.1.1 2.2.2.2 3.3.3.3 -p 8080
Starting Nping ( http://nmap.org/nping )
SENT (0.0230s) TCP 192.168.0.21 > 1.1.1.1:8080
SENT (1.0240s) TCP 192.168.0.21 > 2.2.2.2:8080
SENT (2.0260s) TCP 192.168.0.21 > 3.3.3.3:8080
SENT (3.0270s) TCP 192.168.0.21 > 1.1.1.1:8080
SENT (4.0290s) TCP 192.168.0.21 > 2.2.2.2:8080
SENT (5.0310s) TCP 192.168.0.21 > 3.3.3.3:8080

# nping --tcp -c 1 --delay 500ms 1.1.1.1 2.2.2.2 3.3.3.3 -p 137-139
Starting Nping ( http://nmap.org/nping )
SENT (0.0230s) TCP 192.168.0.21 > 1.1.1.1:137
SENT (0.5250s) TCP 192.168.0.21 > 2.2.2.2:137
SENT (1.0250s) TCP 192.168.0.21 > 3.3.3.3:137
SENT (1.5280s) TCP 192.168.0.21 > 1.1.1.1:138
SENT (2.0280s) TCP 192.168.0.21 > 2.2.2.2:138
SENT (2.5310s) TCP 192.168.0.21 > 3.3.3.3:138
SENT (3.0300s) TCP 192.168.0.21 > 1.1.1.1:139
SENT (3.5330s) TCP 192.168.0.21 > 2.2.2.2:139
SENT (4.0330s) TCP 192.168.0.21 > 3.3.3.3:139

PROBE MODES¶

Nping supports a wide variety of protocols. Although in some cases Nping can automatically determine the mode from the options used, it is generally a good idea to specify it explicitly.

--tcp-connect (TCP Connect mode) .

--tcp (TCP mode) .

--udp (UDP mode) .

--icmp (ICMP mode) .

--arp (ARP/RARP mode) .

--traceroute (Traceroute mode) .

TCP CONNECT MODE¶

-p port_spec, --dest-port port_spec (Target ports) .

-g portnumber, --source-port portnumber (Spoof source port) .

TCP MODE¶

-p port_spec, --dest-port port_spec (Target ports)

-g portnumber, --source-port portnumber (Spoof source port)

--seq seqnumber (Sequence Number) .

--flags flags (TCP Flags) .

--win size (Window Size) .

--badsum (Invalid Checksum) .

UDP MODE¶

-p port_spec, --dest-port port_spec (Target ports) .

-g portnumber, --source-port portnumber (Spoof source port) .

--badsum (Invalid Checksum)

ICMP MODE¶

--icmp-type type (ICMP type) .

--icmp-code code (ICMP code) .

--icmp-id id (ICMP identifier) .

--icmp-seq seq (ICMP sequence) .

--icmp-redirect-addr addr (ICMP Redirect address) .

--icmp-param-pointer pointer (ICMP Parameter Problem pointer) .

--icmp-advert-lifetime ttl (ICMP Router Advertisement Lifetime) .

--icmp-advert-entry addr,pref (ICMP Router Advertisement Entry) .

--icmp-orig-time timestamp (ICMP Originate Timestamp) .

--icmp-recv-time timestamp (ICMP Receive Timestamp) .

--icmp-trans-time timestamp (ICMP Transmit Timestamp) .

ARP MODE¶

--arp-type type (ICMP Type) .

--arp-sender-mac mac (Sender MAC address) .

--arp-sender-ip addr (Sender IP address) .

--arp-target-mac mac (target MAC address) .

--arp-target-ip addr (target ip address) .

IPV4 OPTIONS¶

-S addr, --source-ip addr (Source IP Address) .

--dest-ip addr (Destination IP Address) .

--tos tos (Type of Service) .

--id id (Identification) .

--df (Don't Fragment) .

--mf (More Fragments) .

--ttl hops (Time To Live) .

--badsum-ip (Invalid IP checksum) .

--ip-options S|R [route]|L [route]|T|U ..., --ip-options hex string (IP Options) .

--mtu size (Maximum Transmission Unit) .

IPV6 OPTIONS¶

-6, --ipv6 (Use IPv6) .

-S addr, --source-ip addr (Source IP Address) .

--dest-ip addr (Destination IP Address) .

--flow label (Flow Label) .

--traffic-class class (Traffic Class) .

--hop-limit hops (Hop Limit) .

ETHERNET OPTIONS¶

In most cases Nping sends packets at the raw IP level. This means that Nping creates its own IP packets and transmits them through a raw socket. However, in some cases it may be necessary to send packets at the raw Ethernet level. This happens, for example, when Nping is run under Windows (as Microsoft has disabled raw socket support since Windows XP SP2), or when Nping is asked to send ARP packets. Since in some cases it is necessary to construct ethernet frames, Nping offers some options to manipulate the different fields.

--dest-mac mac (Ethernet Destination MAC Address) .

--source-mac mac (Ethernet Source MAC Address) .

--ether-type type (Ethertype) .

PAYLOAD OPTIONS¶

--data hex string (Append custom binary data to sent packets) .

--data-string string (Append custom string to sent packets) .

--data-length len (Append random data to sent packets) .

ECHO MODE¶

The "Echo Mode" is a novel technique implemented by Nping which lets users see how network packets change in transit, from the host where they originated to the target machine. Basically, the Echo mode turns Nping into two different pieces: the Echo server and the Echo client. The Echo server is a network service that has the ability to capture packets from the network and send a copy ("echo them") to the originating client through a side TCP channel. The Echo client is the part that generates such network packets, transmits them to the server, and receives their echoed version through a side TCP channel that it has previously established with the Echo server.

This scheme lets the client see the differences between the packets that it sends and what is actually received by the server. By having the server send back copies of the received packets through the side channel, things like NAT devices become immediately apparent to the client because it notices the changes in the source IP address (and maybe even source port). Other devices like those that perform traffic shaping, changing TCP window sizes or adding TCP options transparently between hosts, turn up too.

The Echo mode is also useful for troubleshooting routing and firewall issues. Among other things, it can be used to determine if the traffic generated by the Nping client is being dropped in transit and never gets to its destination or if the responses are the ones that don't get back to it.

Internally, client and server communicate over an encrypted and authenticated channel, using the Nping Echo Protocol (NEP), whose technical specification can be found in http://nmap.org/svn/nping/docs/EchoProtoRFC.txt

The following paragraphs describe the different options available in Nping's Echo mode.

--ec passphrase, --echo-client passphrase (Run Echo client) .

--es passphrase, --echo-server passphrase (Run Echo server) .

--ep port, --echo-port port (Set Echo TCP port number) .

--nc, --no-crypto (Disable encryption and authentication) .

--once (Serve one client and quit) .

--safe-payloads (Zero application data before echoing a packet) .

The following examples illustrate how Nping's Echo mode can be used to discover intermediate devices.

Example 2. Discovering NAT devices

    # nping --echo-client "public" echo.nmap.org --udp 


    Starting Nping ( http://nmap.org/nping )


    SENT (1.0970s) UDP 10.1.20.128:53 > 178.79.165.17:40125 ttl=64 id=32523 iplen=28 


    CAPT (1.1270s) UDP 80.38.10.21:45657 > 178.79.165.17:40125 ttl=54 id=32523 iplen=28 


    RCVD (1.1570s) ICMP 178.79.165.17 > 10.1.20.128 Port unreachable (type=3/code=3) ttl=49 id=16619 iplen=56 


    [...]


    SENT (5.1020s) UDP 10.1.20.128:53 > 178.79.165.17:40125 ttl=64 id=32523 iplen=28 


    CAPT (5.1335s) UDP 80.38.10.21:45657 > 178.79.165.17:40125 ttl=54 id=32523 iplen=28 


    RCVD (5.1600s) ICMP 178.79.165.17 > 10.1.20.128 Port unreachable (type=3/code=3) ttl=49 id=16623 iplen=56 


     


    Max rtt: 60.628ms | Min rtt: 58.378ms | Avg rtt: 59.389ms


    Raw packets sent: 5 (140B) | Rcvd: 5 (280B) | Lost: 0 (0.00%)| Echoed: 5 (140B) 


    Tx time: 4.00459s | Tx bytes/s: 34.96 | Tx pkts/s: 1.25


    Rx time: 5.00629s | Rx bytes/s: 55.93 | Rx pkts/s: 1.00


    Nping done: 1 IP address pinged in 6.18 seconds


    

The output clearly shows the presence of a NAT device in the client's local network. Note how the captured packet (CAPT) differs from the SENT packet: the source address for the original packets is in the reserved 10.0.0.0/8 range, while the address seen by the server is 80.38.10.21, the Internet side address of the NAT device. The source port was also modified by the device. The line starting with RCVD corresponds to the responses generated by the TCP/IP stack of the machine where the Echo server is run.

Example 3. Discovering a transparent proxy

    # nping --echo-client "public" echo.nmap.org --tcp -p80


    Starting Nping ( http://nmap.org/nping )


    SENT (1.2160s) TCP 10.0.1.77:41659 > 178.79.165.17:80 S ttl=64 id=3317 iplen=40  seq=567704200 win=1480 


    RCVD (1.2180s) TCP 178.79.165.17:80 > 10.0.1.77:41659 SA ttl=128 id=13177 iplen=44  seq=3647106954 win=16384 <mss 1460>


    SENT (2.2150s) TCP 10.0.1.77:41659 > 178.79.165.17:80 S ttl=64 id=3317 iplen=40  seq=567704200 win=1480 


    SENT (3.2180s) TCP 10.0.1.77:41659 > 178.79.165.17:80 S ttl=64 id=3317 iplen=40  seq=567704200 win=1480 


    SENT (4.2190s) TCP 10.0.1.77:41659 > 178.79.165.17:80 S ttl=64 id=3317 iplen=40  seq=567704200 win=1480 


    SENT (5.2200s) TCP 10.0.1.77:41659 > 178.79.165.17:80 S ttl=64 id=3317 iplen=40  seq=567704200 win=1480 


     


    Max rtt: 2.062ms | Min rtt: 2.062ms | Avg rtt: 2.062ms


    Raw packets sent: 5 (200B) | Rcvd: 1 (46B) | Lost: 4 (80.00%)| Echoed: 0 (0B) 


    Tx time: 4.00504s | Tx bytes/s: 49.94 | Tx pkts/s: 1.25


    Rx time: 5.00618s | Rx bytes/s: 9.19 | Rx pkts/s: 0.20


    Nping done: 1 IP address pinged in 6.39 seconds


    

In this example, the output is a bit more tricky. The absence of error messages shows that the Echo client has successfully established an Echo session with the server. However, no CAPT packets can be seen in the output. This means that none of the transmitted packets reached the server. Interestingly, a TCP SYN-ACK packet was received in response to the first TCP-SYN packet (and also, it is known that the target host does not have port 80 open). This behavior reveals the presence of a transparent web proxy cache server (which in this case is an old MS ISA server).

TIMING AND PERFORMANCE OPTIONS¶

--delay time (Delay between probes) .

--rate rate (Send probes at a given rate) .

MISCELLANEOUS OPTIONS¶

-h, --help (Display help) .

-V, --version (Display version) .

-c rounds, --count rounds (Stop after a given number of rounds) .

-e name, --interface name (Set the network interface to be used) .

--privileged (Assume that the user is fully privileged) .

--unprivileged (Assume that the user lacks raw socket privileges) .

--send-eth (Use raw ethernet sending) .

--send-ip (Send at raw IP level) .

--bpf-filter filter spec --filter filter spec (Set custom BPF filter) .

-H, --hide-sent (Do not display sent packets) .

-N, --no-capture (Do not attempt to capture replies) .

OUTPUT OPTIONS¶

-v[level], --verbose [level] (Increase or set verbosity level) .

-q[level], --reduce-verbosity [level] (Decrease verbosity level) .

-d[level] (Increase or set debugging level) .

NSOCK (1.0000s) Callback: TIMER SUCCESS for EID 12; tcpconnect_event_handler(): Received callback of type TIMER with status SUCCESS

BUGS¶

Like its author, Nping isn't perfect. But you can help make it better by sending bug reports or even writing patches. If Nping doesn't behave the way you expect, first upgrade to the latest Nmap version available from http://nmap.org/download.html. If the problem persists, do some research to determine whether it has already been discovered and addressed. Try searching for the error message on our search page at http://insecure.org/search.html or at Google. Also try browsing the nmap-dev archives at http://seclists.org/. Read this full manual page as well. If nothing comes out of this, mail a bug report to <dev@nmap.org>. Please include everything you have learned about the problem, as well as what version of Nping you are running and what operating system version it is running on. Problem reports and Nping usage questions sent to <dev@nmap.org> are far more likely to be answered than those sent to Fyodor directly. If you subscribe to the nmap-dev list before posting, your message will bypass moderation and get through more quickly. Subscribe at http://nmap.org/mailman/listinfo/dev.

Code patches to fix bugs are even better than bug reports. Basic instructions for creating patch files with your changes are available at https://svn.nmap.org/nmap/HACKING. Patches may be sent to nmap-dev (recommended) or to any of the authors listed in the next section directly.

AUTHORS¶

Luis MartinGarcia <luis.mgarc@gmail.com> (http://aldabaknocking.com)

Fyodor <fyodor@nmap.org> (http://insecure.org)

NOTES¶

1.

official type numbers assigned by IANA

2.

official numbers assigned by IANA

3.

official numbers listed by the IEEE