1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
|
++++++++++++++++++++++++++++++++++
| NPING COMMAND LINE INTERFACE |
++++++++++++++++++++++++++++++++++
This document presents Nping's command line interface. All option flags are
now definitive. Howerever, comments and suggestions are still welcome.
Nping 0.01a ( https://nmap.org/nping )
Usage: nping [Probe mode] [Options] {target specification}
TARGET SPECIFICATION:
Targets may be specified as hostnames, IP addresses, networks, etc.
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
-iL <inputfilename>: Read targets from list of hosts or networks
PROBE MODES:
--tcp-connect : Unprivileged TCP connect probe mode.
--tcp : TCP probe mode.
--upd : UPD probe mode.
--icmp : ICMP probe mode.
--arp : ARP Request probe mode.
--rarp : RARP Request probe mode.
--arp-response : ARP Response probe mode.
--rarp-response : RARP Response probe mode.
-tr, --traceroute : Traceroute mode (can be used together with TCP/UDP/ICMP
pings, but not with ARP ping)
TCP PROBE MODE:
-g, --source-port <portnumber> : Set source port.
-p, --dest-port <portnumber> : Set destination port.
--seq <seqnumber> : Set sequence number.
--flags <flags> : Set TCP flags.
--ack <acknumber> : Set ACK number.
--win <size> : Set window size.
--badsum : Use a random invalid checksum.
--mss <size> : Set maximum segment size.
--ws <n> : Set window scale.
--ts <echo,reply> : Set timestamp (echo and reply fields).
UDP PROBE MODE:
-g, --source-port <portnumber> : Set source port.
-p, --dest-port <portnumber> : Set destination port.
--badsum : Use a random invalid checksum.
ICMP PROBE MODE:
-I3, --dest-unr : Send "destination unreacheable" messages.
-I8, --echo-req : Send "echo request" messages.
-I13, --ts-req : Send "timestamp request" messages.
-I15, --info-req : Send "Information request" messages.
-I17, --netmask-req : Send "Netmask request" messages.
--icmp-code <code> : ICMP code.
--icmp-id <id> : Sets field "Identifier" in echo messages (16bits).
--icmp-seq <n> : Sets field "Sequence number" in echo messages (16 bits).
ARP/RARP PROBE MODE:
--arp-sender-mac <mac> : Set sender MAC address.
--arp-sender-ip <ip> : Set sender IP address.
--arp-target-mac <mac> : Set target MAC address.
--arp-target-ip <ip> : Set target IP address.
ETHERNET OPTIONS:
--dest-mac : Set destination mac address. This disables ARP resolution.
--source-mac : Set source MAC address.
IP OPTIONS:
-S, --source-ip : Set source IP address.
--dest-ip : Set destination IP address (used as an alternative to
{target specification} ).
--tos <val> : Set type of service field (8bits).
--id <val> : Set identification field (16 bits).
--df : Set Don't Fragment flag.
--mf : Set More Fragments flag.
--ttl <val> : Set time to live [0-256].
--badsum-ip : Use a random invalid checksum.
--ip-options S|R [route]|L [route]|T|U ... : Set IP options
--ip-options hex string : Set IP options
--mtu <len> : Set MTU. Packets get fragmented if MTU is small enough.
-f : Fragment packets.
PAYLOAD OPTIONS:
--data <hex string> : Include TCP/UPD/ICMP payload (if it makes sense).
--data-file <filename> : Get payload from specified file.
--data-length <len> : Include len random bytes as payload.
ECHO CLIENT/SERVER:
-K, --ekey <hex> : Key to be used for encryption/decryption.
-P, --passphrase : Passphrase to derive an encryption key from.
CLIENT-ONLY OPTIONS:
--client : Run Nping in client mode.
--interpret : Interpret received echoes.
SERVER-ONLY OPTIONS:
--server : Run Nping in server mode.
--echo-link : Return back: link+net+transport+payload
--echo-net : Return back: net+transport+payload
--echo-trans : Return back: transport+payload
--echo-data : Just return payload.
TIMING AND PERFORMANCE:
Options which take <time> are in milliseconds, unless you append 's'
(seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
--delay <time> : Adjust delay between probes.
--rate <num> : Send num packets per second.
--host-timeout <time> : Give up on target after this long.
MISC:
-h, --help : Display help information on stardard output.
-V, --version : Display Nping current version number.
-c, --count <n> : Stop after sending (and receiving) n response packets.
-e, --interface <name> : Use supplied network interface.
--privileged : Assume that the user is fully privileged.
--unprivileged : Assume the user lacks raw socket privileges.
--send-eth : Send packets at the raw ethernet layer.
--send-ip : Send packets using raw IP sockets.
OUTPUT:
-v : Increment verbosity level by one.
-v[level] : Set verbosity level. E.g: -v4
-d : Increment debugging level by one.
-d[level] : Set debugging level. E.g: -d3
--quiet : Sets verbosity and debug level to zero. (Same as -v0 -d0)
--debug : Sets verbosity and debug to their highest level.
EXAMPLES:
nping scanme.nmap.org
nping --tcp --dest-port 80 --ttl 2 192.168.1.1
nping --debug --icmp -I17 --delay 2s microsoft.com
SEE THE MAN PAGE FOR MANY MORE OPTIONS, DESCRIPTIONS, AND EXAMPLES
+------------------------------------------------------------------------------+
NOTES:
In places where a port number, an IP address, etc, is expected, it is possible
to specify the word "rand" or "random", so Nping sets a random value for that
option.
E.g: nping --tcp --dest-port random 192.168.1.1
nping --udp --source-port random --source-mac random 207.46.197.32
nping --arp --sender-ip random --ttl random scanme.nmap.org
In places where a MAC address is expected, it is possible to especify a MAC
address, a prefix or a vendor name. Missing information will be completed with
random values.
+------------------------------------------------------------------------------+
|
