инструмент генерации сетевых пакетов / утилита ping (Network packet generation tool / ping utility)
PROBE MODES
Nping supports a wide variety of protocols. Although in some
cases Nping can automatically determine the mode from the options
used, it is generally a good idea to specify it explicitly.
--tcp-connect (TCP Connect mode)
TCP connect mode is the default mode when a user does not
have raw packet privileges. Instead of writing raw packets as
most other modes do, Nping asks the underlying operating
system to establish a connection with the target machine and
port by issuing the connect system call. This is the same
high-level system call that web browsers, P2P clients, and
most other network-enabled applications use to establish a
connection. It is part of a programming interface known as
the Berkeley Sockets API. Rather than read raw packet
responses off the wire, Nping uses this API to obtain status
information on each connection attempt. For this reason, you
will not be able to see the contents of the packets that are
sent or received but only status information about the TCP
connection establishment taking place.
--tcp (TCP mode)
TCP is the mode that lets users create and send any kind of
TCP packet. TCP packets are sent embedded in IP packets that
can also be tuned. This mode can be used for many different
purposes. For example you could try to discover open ports by
sending TCP SYN messages without completing the three-way
handshake. This technique is often referred to as half-open
scanning, because you don't open a full TCP connection. You
send a SYN packet, as if you are going to open a real
connection and then wait for a response. A SYN/ACK indicates
the port is open, while a RST indicates it's closed. If no
response is received one could assume that some intermediate
network device is filtering the responses. Another use could
be to see how a remote TCP/IP stack behaves when it receives
a non-RFC-compliant packet, like one with both SYN and RST
flags set. One could also do some evil by creating custom RST
packets using an spoofed IP address with the intent of
closing an active TCP connection.
--udp (UDP mode)
UDP mode can have two different behaviours. Under normal
circumstances, it lets users create custom IP/UDP packets.
However, if Nping is run by a user without raw packet
privileges and no changes to the default protocol headers are
requested, then Nping enters the unprivileged UDP mode which
basically sends UDP packets to the specified target hosts and
ports using the sendto system call. Note that in this
unprivileged mode it is not possible to see low-level header
information of the packets on the wire but only status
information about the amount of bytes that are being
transmitted and received. UDP mode can be used to interact
with any UDP-based server. Examples are DNS servers,
streaming servers, online gaming servers, and port
knocking/single-packet authorization daemons.
--icmp (ICMP mode)
ICMP mode is the default mode when the user runs Nping with
raw packet privileges. Any kind of ICMP message can be
created. The default ICMP type is Echo, i.e., ping. ICMP mode
can be used for many different purposes, from a simple
request for a timestamp or a netmask to the transmission of
fake destination unreachable messages, custom redirects, and
router advertisements.
--arp (ARP/RARP mode)
ARP lets you create and send a few different ARP-related
packets. These include ARP, RARP, DRARP, and InARP requests
and replies. This mode can ban be used to perform low-level
host discovery, and conduct ARP-cache poisoning attacks.
--traceroute (Traceroute mode)
Traceroute is not a mode by itself but a complement to TCP,
UDP, and ICMP modes. When this option is specified Nping will
set the IP TTL value of the first probe to 1. When the next
router receives the packet it will drop it due to the
expiration of the TTL and it will generate an ICMP
destination unreachable message. The next probe will have a
TTL of 2 so now the first router will forward the packet
while the second router will be the one that drops the packet
and generates the ICMP message. The third probe will have a
TTL value of 3 and so on. By examining the source addresses
of all those ICMP Destination Unreachable messages it is
possible to determine the path that the probes take until
they reach their final destination.
