Show Menu

Hping3 version 1.4 Cheat Sheet (DRAFT) by

This is a draft cheat sheet. It is a work in progress and is not finished yet.

Base Options

show this help
show version
packet count
wait (uX for X micros­econds, for example -i u1000)
alias for -i u10000 (10 packets for second)
alias for -i u1000 (100 packets for second)
sent packets as fast as possible. Don't show replies.
numeric output
interface name (otherwise default routing interface)
verbose mode
debugging info
bind ctrl+z to ttl (default to dst port)
unbind ctrl+z
beep for every matching packet received


default mode
RAW IP mode
ICMP mode
UDP mode
SCAN mode
Example: hping --scan 1-30,70-90 -S www.ta­rge­
listen mode


spoof source addess
random destio­nation address mode
random source address mode
ttl (default 64)
id (default random)
use win* id byte ordering
relativize id field (to estimate host traffic)
split packets in more frag
set more fragments flag
set don't fragment flag
set the fragment offset
set virtual mtu, implies --frag if packet size > mtu
type of service (default 0x00), try --tos help
includes RECORD­_ROUTE option and display the route buffer
loose source routing and record route
strict source routing and record route
set the IP protocol field, only in RAW IP mode


icmp type (default echo request)
icmp code (default 0)
send all icmp types (default send only supported types)
set gateway address for ICMP redirect (default
Alias for --icmp --icmptype 13 (ICMP timestamp)
Alias for --icmp --icmptype 17 (ICMP address subnet mask)
display help for others icmp options


-s --baseport
base source port (default random)