A regular ping command only sends one type of packet (ICMP Echo Request), which is exactly why many modern firewalls simply ignore it. hping3 goes a step further: it lets you craft fully custom TCP, UDP, or ICMP packets (with any combination of flags, ports, and TTL) — exactly the tool needed to understand how a firewall or intrusion detection system actually behaves.
Important: every command in this tutorial should only be run against systems and networks you have explicit authorization to test — like your own personal lab or a formal penetration-testing engagement. Using these tools against any network or system without permission is a crime.
Installing hping3
sudo apt install hping3
Step 1: Using it like a regular ping (ICMP mode)
sudo hping3 -1 192.168.1.10
Mode -1 means ICMP mode — behavior similar to a regular ping, but with much more control over packet details.
Step 2: Crafting a TCP SYN packet to test a specific port
sudo hping3 -S -p 80 -c 3 192.168.1.10
This means: send a packet with the SYN flag set (-S), to port 80 (-p 80), just 3 times (-c 3). This is exactly the first packet your browser sends when opening a website.
Step 3: Reading the response and understanding port state
hping3's response falls into a few states you need to learn to read:
Flags=SA (SYN-ACK): the port is open and a service is listening.
Flags=RA (RST-ACK): the port is closed, but the system responds directly (meaning no firewall between you and the target is dropping the packet).
No response received: this is the most interesting case — it means either the port is actively being dropped by a firewall (filtered), or the system simply doesn't respond at all.
Step 4: Testing multiple ports to map firewall rules
sudo hping3 -S -p 22 -c 2 192.168.1.10
sudo hping3 -S -p 443 -c 2 192.168.1.10
sudo hping3 -S -p 3389 -c 2 192.168.1.10
By repeating this across several ports, you can figure out exactly what rules the firewall has — for example, port 443 is open but 3389 (RDP) is completely filtered, indicating a specific ACL or firewall rule is defined for it (exactly the concept we saw in my Cisco ACL tutorial).
Step 5: Traceroute-style path discovery with hping3
sudo hping3 --traceroute -V -1 192.168.1.10
This mode shows the path a packet takes to reach its destination — sometimes more useful than a regular traceroute, since it uses a protocol and port that a firewall might not be filtering (unlike plain ICMP, which many firewalls block).
Why is hping3 essential for penetration testing?
Nmap is great for fast, broad scanning, but when you need precise control over every bit of a packet (to test a specific firewall rule or evaluate an intrusion detection system), hping3 is the tool that gives you that level of precision. This is exactly the kind of analytical skill we focus on in my network security courses.
Blog