hping3 Command in Linux: Syntax, Options & Practical Examples (Ubuntu)

Deepak Prasad
Tested on Ubuntu 25.04 (Plucky Puffin)
Package hping3 3.0.0-alpha-2
hping3 3.0.0-alpha-2
Applies to Ubuntu, Debian, RHEL
Privilege sudo or root
Man page hping3(8)
Scope hping3 crafts and sends custom TCP, UDP, and ICMP packets on Linux. Network admins use it for connectivity checks, port probes, firewall rule validation, and latency tests when ping is not enough.
Related guides tcpdump command cheat sheet
ss
traceroute
Linux commands

hping3 — quick reference

Protocol mode

Default mode is TCP. Switch with -0, -1, -2, or scan mode -8.

When to use Command
TCP mode (default) sudo hping3 127.0.0.1
ICMP echo mode (ping-like) sudo hping3 -1 127.0.0.1
UDP mode sudo hping3 -2 127.0.0.1
Scan mode — probe port list sudo hping3 -8 22,80 -S 127.0.0.1

TCP flags

Set control bits on crafted TCP probes.

When to use Command
SYN packet sudo hping3 -S 127.0.0.1
ACK packet sudo hping3 -A 127.0.0.1
FIN packet sudo hping3 -F 127.0.0.1
RST packet sudo hping3 -R 127.0.0.1
PSH packet sudo hping3 -P 127.0.0.1
URG packet sudo hping3 -U 127.0.0.1
Xmas flags (FIN+PSH+URG) sudo hping3 -F -P -U 127.0.0.1

Ports and scan helpers

When to use Command
Destination port sudo hping3 -S -p 22 127.0.0.1
Base source port sudo hping3 -S -s 5050 -p 22 127.0.0.1
Scan ports 20–100 with SYN sudo hping3 --scan 20-100 -S 127.0.0.1
Increment destination port each packet sudo hping3 -S -p ++22 127.0.0.1

Packet size, timing, and TTL

When to use Command
Send N packets then stop sudo hping3 -1 -c 10 127.0.0.1
Payload size in bytes sudo hping3 -S -d 64 -p 22 127.0.0.1
Interval between packets (microseconds) sudo hping3 -S -i u1000000 -p 22 127.0.0.1
IP TTL value sudo hping3 -S -t 64 -p 22 127.0.0.1
TCP window size sudo hping3 -S -w 512 -p 22 127.0.0.1

Output and interface

When to use Command
Numeric output (no DNS) sudo hping3 -n -S -p 22 127.0.0.1
Verbose replies sudo hping3 -V -S -p 22 127.0.0.1
Quiet mode sudo hping3 -q -S -p 22 127.0.0.1
Bind to network interface sudo hping3 -I lo -S -p 22 127.0.0.1

Help and version

When to use Command
Show usage hping3 -h
Show version hping3 -V

Use only on systems and addresses you are allowed to test. Examples on this page use 127.0.0.1 (localhost).

hping3 — command syntax

Synopsis from hping3 --help on Ubuntu 25.04 (hping3 3.0.0-alpha-2):

text
hping3 host [options]

hping3 builds raw IP packets. It needs sudo on Linux because normal users cannot open raw sockets. It does not modify firewall configuration — it only sends probes and prints replies.

hping3 — command examples

Essential ICMP echo to localhost (-1)

When ICMP is allowed, -1 behaves like ping with control over count, interval, and payload size.

Run the command:

bash
sudo hping3 -1 -c 3 127.0.0.1

Sample output:

output
HPING 127.0.0.1 (lo 127.0.0.1): icmp mode set, 28 headers + 0 data bytes
len=28 ip=127.0.0.1 ttl=64 id=55549 icmp_seq=0 rtt=1.0 ms
len=28 ip=127.0.0.1 ttl=64 id=56169 icmp_seq=1 rtt=0.9 ms
len=28 ip=127.0.0.1 ttl=64 id=56222 icmp_seq=2 rtt=0.6 ms

--- 127.0.0.1 hping statistic ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.6/0.8/1.0 ms

0% packet loss and RTT lines confirm localhost responds to ICMP echo.

Essential TCP SYN probe on port 22

Test whether a TCP port accepts connections by sending SYN and reading SYN-ACK or RST.

Run the command:

bash
sudo hping3 -S -p 22 -c 2 127.0.0.1

Sample output:

output
HPING 127.0.0.1 (lo 127.0.0.1): S set, 40 headers + 0 data bytes
len=44 ip=127.0.0.1 ttl=64 DF id=0 sport=22 flags=SA seq=0 win=65495 rtt=2.3 ms
len=44 ip=127.0.0.1 ttl=64 DF id=0 sport=22 flags=SA seq=1 win=65495 rtt=4.1 ms

--- 127.0.0.1 hping statistic ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 2.3/3.2/4.1 ms

flags=SA is SYN-ACK — port 22 is open on localhost.

Essential Scan a few ports (--scan)

hping3 scan mode sends probes across a port list — lighter than a full nmap run for two or three ports.

Run the command:

bash
sudo hping3 --scan 22,80 -S 127.0.0.1

Sample output:

output
Scanning 127.0.0.1 (127.0.0.1), port 22,80
2 ports to scan, use -V to see all the replies
+----+-----------+---------+---+-----+-----+-----+
|port| serv name |  flags  |ttl| id  | win | len |
+----+-----------+---------+---+-----+-----+-----+
   22 ssh        : .S..A...  64     0 65495    44
All replies received. Done.
Not responding ports:

Port 22 answered; port 80 did not respond (closed or filtered).

Common Numeric output without DNS (-n)

On slow DNS, -n keeps output to IP addresses only.

Run the command:

bash
sudo hping3 -n -S -p 22 -c 1 127.0.0.1

Sample output:

output
HPING 127.0.0.1 (lo 127.0.0.1): S set, 40 headers + 0 data bytes
len=44 ip=127.0.0.1 ttl=64 DF id=0 sport=22 flags=SA seq=0 win=65495 rtt=3.0 ms

--- 127.0.0.1 hping statistic ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 3.0/3.0/3.0 ms

No reverse DNS lookups appear in the transcript.

Common UDP probe and ICMP unreachable (-2)

UDP has no handshake — closed ports often return ICMP port unreachable.

Run the command:

bash
sudo hping3 -2 -p 53 -c 2 127.0.0.1

Sample output:

output
HPING 127.0.0.1 (lo 127.0.0.1): udp mode set, 28 headers + 0 data bytes
ICMP Port Unreachable from ip=127.0.0.1 name=localhost status=0 port=2279 seq=0
ICMP Port Unreachable from ip=127.0.0.1 name=localhost status=0 port=2280 seq=1

--- 127.0.0.1 hping statistic ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 1.8/23.8/45.7 ms

Replies are ICMP errors, not UDP payloads — still useful to see how the host handles UDP to a closed port.

Common Custom TCP payload size (-d)

Vary data size to test MTU paths or IDS behavior on authorized lab hosts.

Run the command:

bash
sudo hping3 -S -p 22 -d 64 -c 2 127.0.0.1

Sample output:

output
HPING 127.0.0.1 (lo 127.0.0.1): S set, 40 headers + 64 data bytes
len=44 ip=127.0.0.1 ttl=64 DF id=0 sport=22 flags=SA seq=0 win=65495 rtt=1.0 ms
len=44 ip=127.0.0.1 ttl=64 DF id=0 sport=22 flags=SA seq=1 win=65495 rtt=0.3 ms

--- 127.0.0.1 hping statistic ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.3/0.7/1.0 ms

The banner shows 64 data bytes in the probe even though the reply line may list header length only.

Common Slow interval and TTL (-i -t)

Control probe rate and IP TTL for path or firewall experiments on localhost.

Run the command:

bash
sudo hping3 -S -p 22 -i u1000000 -t 64 -c 2 127.0.0.1

Sample output:

output
HPING 127.0.0.1 (lo 127.0.0.1): S set, 40 headers + 0 data bytes
len=44 ip=127.0.0.1 ttl=64 DF id=0 sport=22 flags=SA seq=0 win=65495 rtt=0.5 ms
len=44 ip=127.0.0.1 ttl=64 DF id=0 sport=22 flags=SA seq=1 win=65495 rtt=0.9 ms

--- 127.0.0.1 hping statistic ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.5/0.7/0.9 ms

-i u1000000 waits one second between packets (microsecond syntax).

Advanced RST reply on a closed port (flags=RA)

A SYN to a port with no listener usually comes back as RST+ACK — different from an open port's SYN-ACK.

Run the command:

bash
sudo hping3 -S -p 9999 -c 1 127.0.0.1

Sample output:

output
HPING 127.0.0.1 (lo 127.0.0.1): S set, 40 headers + 0 data bytes
len=40 ip=127.0.0.1 ttl=64 DF id=0 sport=9999 flags=RA seq=0 win=0 rtt=1.3 ms

--- 127.0.0.1 hping statistic ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 1.3/1.3/1.3 ms

flags=RA is RST+ACK — the kernel rejects the connection attempt because nothing listens on 9999.

Advanced Custom TCP window (-w)

Set the TCP window field in the probe — occasionally relevant for stack or middlebox testing.

Run the command:

bash
sudo hping3 -S -p 22 -w 512 -c 1 127.0.0.1

Sample output:

output
HPING 127.0.0.1 (lo 127.0.0.1): S set, 40 headers + 0 data bytes
len=44 ip=127.0.0.1 ttl=64 DF id=0 sport=22 flags=SA seq=0 win=65495 rtt=0.9 ms

--- 127.0.0.1 hping statistic ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.9/0.9/0.9 ms

The reply win= value comes from the target stack, not your -w setting.

Advanced Unusual TCP flag combo (FIN+PSH+URG)

Firewalls sometimes treat odd flag combinations differently from a plain SYN — useful in authorized firewall lab work on localhost.

Run the command:

bash
sudo hping3 -F -P -U -p 80 -c 1 127.0.0.1

Sample output:

output
HPING 127.0.0.1 (lo 127.0.0.1): FPU set, 40 headers + 0 data bytes
len=40 ip=127.0.0.1 ttl=64 DF id=0 sport=80 flags=RA seq=0 win=0 rtt=0.4 ms

--- 127.0.0.1 hping statistic ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.4/0.4/0.4 ms

Closed port 80 still returns RA here; a silent drop on a remote filtered port would show 100% packet loss instead.

hping3 — when to use / when not

Use hping3 when Use something else when
  • You need a single custom packet or a tiny port probe
  • ICMP ping is blocked but you can test TCP to a known port
  • You are validating firewall rules on a lab or authorized host
  • You want manual control of flags, TTL, size, and timing
  • You need a full multi-port scan with versions and scripts → nmap
  • You only need basic reachability → ping
  • You need to capture traffic for analysis → tcpdump
  • You want high-rate flood testing → out of scope; use dedicated lab tools with approval

hping3 vs ping

For plain ICMP echo without custom headers, start with the ping command; reach for hping3 when you need crafted TCP/UDP/ICMP probes.

ping hping3
Default protocol ICMP echo TCP
Custom TCP flags No Yes
UDP probes No Yes (-2)
Port selection No Yes (-p, --scan)
Privilege Often setuid or cap Usually sudo
Best for Simple liveness Firewall and port-level tests

hping3 — interview corner

What is hping3?

hping3 is a packet crafter — it sends TCP, UDP, or ICMP packets with chosen flags, ports, sizes, and timing, then prints replies. It is used for connectivity checks beyond plain ping and for firewall rule tests on authorized systems.

bash
sudo hping3 -S -p 22 -c 1 127.0.0.1

A strong answer is:

"hping3 sends custom TCP/UDP/ICMP probes. I use it for SYN tests to a port when ICMP is blocked — always on hosts I'm allowed to test."

How do you interpret SYN-ACK vs RST?

On a SYN probe, SYN-ACK (SA) usually means the port is open. RST (RA) means closed. No response often means filtered or dropped by a firewall.

A strong answer is:

"SA on a SYN probe means open; RA means closed; silence often means filtered. I confirm with multiple samples and known-good baselines."

hping3 vs nmap?

nmap orchestrates large scans, service detection, and NSE scripts. hping3 fires individual or small batches of crafted packets — better for a quick SYN test or firewall experiment.

A strong answer is:

"nmap for comprehensive scans and versions; hping3 for manual packet-level tests and small port probes."

Why does hping3 need root?

Raw sockets let hping3 build IP and TCP/UDP headers directly. Linux restricts that to privileged users.

A strong answer is:

"hping3 needs raw socket access to craft packets — I run it with sudo unless capabilities are explicitly granted."

When use hping3 -1 vs ping?

-1 is ICMP mode — similar to ping but integrated with hping3's flags (-c, -d, -i, TTL). Use it when you want hping3's scripting style or combined TCP/ICMP tests in one tool.

A strong answer is:

"hping3 -1 is ICMP echo with hping3's options. I use it when I need the same tool to switch between ICMP and TCP probes in a script."

Troubleshooting

Symptom Likely cause Fix
you haven't the right to open a raw socket Missing raw-socket privilege on this distro sudo hping3 … (raw sockets usually need root)
100% packet loss on open port Wrong interface, firewall, or typo in port Try -I lo on localhost; verify service listens
Scan shows no row for a port Closed or filtered Compare with ss -tln locally
Hangs between packets Default flood of replies or DNS Add -c count, -n, or -q
Unknown host Bad hostname Use IP or fix /etc/resolv.conf

References

Rohan Timalsina

is a technical writer and Linux enthusiast who writes practical guides on Linux commands and system administration. He focuses on simplifying complex topics through clear explanations.

Expertise
  • Linux
  • HTML5
  • JavaScript
  • Web Design
  • Front-end Web Development

Related Articles

linux

Troubleshoot Default Routes in Linux

Troubleshoot Linux default route problems by reading ip route show default and ip route get, understanding …

9 min readlinux

Troubleshoot Slow Network Speed in Linux

Troubleshoot Linux slow network speed by measuring throughput with curl and iperf3, checking latency and …

8 min readlinux

Troubleshoot Packet Loss in Linux

Troubleshoot Linux packet loss by confirming drops with ping statistics, locating the failing hop with mtr, …

11 min read