OS Manuals

/usr/bin/nping

network discovery and security auditing tool

From nmap 7.993-r1 (extra-packages), captured 2026-11-05 by running nping --help (exit 0). permalink

Nping 7.993 ( https://nmap.org/nping )
Usage: nping [Probe mode] [Options] {target specification}

TARGET SPECIFICATION:
  Targets may be specified as hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.*.1-24
PROBE MODES:
  --tcp-connect                    : Unprivileged TCP connect probe mode.
  --tcp                            : TCP probe mode.
  --udp                            : UDP probe mode.
  --icmp                           : ICMP probe mode.
  --arp                            : ARP/RARP probe mode.
  --tr, --traceroute               : Traceroute mode (can only be used with
                                     TCP/UDP/ICMP modes).
TCP CONNECT MODE:
   -p, --dest-port <port spec>     : Set destination port(s).
   -g, --source-port <portnumber>  : Try to use a custom source port.
TCP PROBE MODE:
   -g, --source-port <portnumber>  : Set source port.
   -p, --dest-port <port spec>     : Set destination port(s).
   --seq <seqnumber>               : Set sequence number.
   --flags <flag list>             : Set TCP flags (ACK,PSH,RST,SYN,FIN...)
   --ack <acknumber>               : Set ACK number.
   --win <size>                    : Set window size.
   --badsum                        : Use a random invalid checksum.
UDP PROBE MODE:
   -g, --source-port <portnumber>  : Set source port.
   -p, --dest-port <port spec>     : Set destination port(s).
   --badsum                        : Use a random invalid checksum.
ICMP PROBE MODE:
  --icmp-type <type>               : ICMP type.
  --icmp-code <code>               : ICMP code.
  --icmp-id <id>                   : Set identifier.
  --icmp-seq <n>                   : Set sequence number.
  --icmp-redirect-addr <addr>      : Set redirect address.
  --icmp-param-pointer <pnt>       : Set parameter problem pointer.
  --icmp-advert-lifetime <time>    : Set router advertisement lifetime.
  --icmp-advert-entry <IP,pref>    : Add router advertisement entry.
  --icmp-orig-time  <timestamp>    : Set originate timestamp.
  --icmp-recv-time  <timestamp>    : Set receive timestamp.
  --icmp-trans-time <timestamp>    : Set transmit timestamp.
ARP/RARP PROBE MODE:
  --arp-type <type>                : Type: ARP, ARP-reply, RARP, RARP-reply.
  --arp-sender-mac <mac>           : Set sender MAC address.
  --arp-sender-ip  <addr>          : Set sender IP address.
  --arp-target-mac <mac>           : Set target MAC address.
  --arp-target-ip  <addr>          : Set target IP address.
IPv4 OPTIONS:
  -S, --source-ip                  : Set source IP address.
  --dest-ip <addr>                 : Set destination IP address (used as an
                                     alternative to {target specification} ).
  --tos <tos>                      : Set type of service field (8bits).
  --id  <id>                       : Set identification field (16 bits).
  --df                             : Set Don't Fragment flag.
  --mf                             : Set More Fragments flag.
  --evil                           : Set Reserved / Evil flag.
  --ttl <hops>                     : Set time to live [0-255].
  --badsum-ip                      : Use a random invalid checksum.
  --ip-options <R|S [route]|L [route]|T|U ...> : Set IP options
  --ip-options <hex string>                    : Set IP options
  --mtu <size>                     : Set MTU. Packets get fragmented if MTU is
                                     small enough.
IPv6 OPTIONS:
  -6, --IPv6                       : Use IP version 6.
  --dest-ip                        : Set destination IP address (used as an
                                     alternative to {target specification}).
  --hop-limit                      : Set hop limit (same as IPv4 TTL).
  --traffic-class <class> :        : Set traffic class.
  --flow <label>                   : Set flow label.
ETHERNET OPTIONS:
  --dest-mac <mac>                 : Set destination mac address. (Disables
                                     ARP resolution)
  --source-mac <mac>               : Set source MAC address.
  --ether-type <type>              : Set EtherType value.
PAYLOAD OPTIONS:
  --data <hex string>              : Include a custom payload.
  --data-string <text>             : Include a custom ASCII text.
  --data-length <len>              : Include len random bytes as payload.
ECHO CLIENT/SERVER:
  --echo-client <passphrase>       : Run Nping in client mode.
  --echo-server <passphrase>       : Run Nping in server mode.
  --echo-port <port>               : Use custom <port> to listen or connect.
  --no-crypto                      : Disable encryption and authentication.
  --once                           : Stop the server after one connection.
  --safe-payloads                  : Erase application data in echoed packets.
TIMING AND PERFORMANCE:
  Options which take <time> are in seconds, or append 'ms' (milliseconds),
  's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m, 0.25h).
  --delay <time>                   : Adjust delay between probes.
  --rate  <rate>                   : Send num packets per second.
MISC:
  -h, --help                       : Display help information.
  -V, --version                    : Display current version number.
  -c, --count <n>                  : Stop after <n> rounds.
  -e, --interface <name>           : Use supplied network interface.
  -H, --hide-sent                  : Do not display sent packets.
  -N, --no-capture                 : Do not try to capture replies.
  --privileged                     : Assume user is fully privileged.
  --unprivileged                   : Assume user lacks raw socket privileges.
  --send-eth                       : Send packets at the raw Ethernet layer.
  --send-ip                        : Send packets using raw IP sockets.
  --bpf-filter <filter spec>       : Specify custom BPF filter.
OUTPUT:
  -v                               : Increment verbosity level by one.
  -v[level]                        : Set verbosity level. E.g: -v4
  -d                               : Increment debugging level by one.
  -d[level]                        : Set debugging level. E.g: -d3
  -q                               : Decrease verbosity level by one.
  -q[N]                            : Decrease verbosity level N times
  --quiet                          : Set verbosity and debug level to minimum.
  --debug                          : Set verbosity and debug to the max level.
EXAMPLES:
  nping scanme.nmap.org
  nping --tcp -p 80 --flags rst --ttl 2 192.168.1.1
  nping --icmp --icmp-type time --delay 500ms 192.168.254.254
  nping --echo-server "public" -e wlan0 -vvv
  nping --echo-client "public" echo.nmap.org --tcp -p1-1024 --flags ack

SEE THE MAN PAGE FOR MANY MORE OPTIONS, DESCRIPTIONS, AND EXAMPLES
Options (74)
OptionDescriptionSource
--tcp-connect: Unprivileged TCP connect probe mode.help
--tcp: TCP probe mode.help
--udp: UDP probe mode.help
--icmp: ICMP probe mode.help
--arp: ARP/RARP probe mode.help
--tr, --traceroute: Traceroute mode (can only be used with TCP/UDP/ICMP modes).help
-p, --dest-port port: Set destination port(s).help
-g, --source-port portnumber: Try to use a custom source port.help
--seq seqnumber: Set sequence number.help
--flags flag: Set TCP flags (ACK,PSH,RST,SYN,FIN...)help
--ack acknumber: Set ACK number.help
--win size: Set window size.help
--badsum: Use a random invalid checksum.help
--icmp-type type: ICMP type.help
--icmp-code code: ICMP code.help
--icmp-id id: Set identifier.help
--icmp-seq n: Set sequence number.help
--icmp-redirect-addr addr: Set redirect address.help
--icmp-param-pointer pnt: Set parameter problem pointer.help
--icmp-advert-lifetime time: Set router advertisement lifetime.help
--icmp-advert-entry IP: Add router advertisement entry.help
--icmp-orig-time<timestamp> : Set originate timestamp.help
--icmp-recv-time<timestamp> : Set receive timestamp.help
--icmp-trans-time timestamp: Set transmit timestamp.help
--arp-type type: Type: ARP, ARP-reply, RARP, RARP-reply.help
--arp-sender-mac mac: Set sender MAC address.help
--arp-sender-ip<addr> : Set sender IP address.help
--arp-target-mac mac: Set target MAC address.help
--arp-target-ip<addr> : Set target IP address.help
-S, --source-ip addrSets the source IP address.help + man
--dest-ip addr: Set destination IP address (used as an alternative to {target specification} ).help + man
--tos tos: Set type of service field (8bits).help + man
--id id<id> : Set identification field (16 bits).help + man
--df (Don'tSets the Don't Fragment bit in sent packets.help + man
--mf (MoreSets the More Fragments bit in sent packets.help + man
--evil (ReservedSets the Reserved / Evil bit in sent packets.help + man
--ttl hopsSets the IPv4 Time-To-Live (TTL) field in sent packets to the given value.help + man
--badsum-ip (InvalidAsks Nping to use an invalid IP checksum for packets sent to target hosts.help + man
--ip-options hexThe IP protocol offers several options which may be placed in packet headers.help + man
--mtu sizeThis option sets a fictional MTU in Nping so IP datagrams larger than size are fragmented before transmission.help + man
-6, --IPv6, --ipv6 (UseTells Nping to use IP version 6 instead of the default IPv4.help + man
--hop-limit hopsSets the IPv6 Hop Limit field in sent packets to the given value.help + man
--traffic-class classSets the IPv6 Traffic Class.help + man
--flow labelSets the IPv6 Flow Label.help + man
--dest-mac macThis option sets the destination MAC address that should be set in outgoing Ethernet frames.help + man
--source-mac macThis option sets the source MAC address that should be set in outgoing Ethernet frames.help + man
--ether-type typeThis option sets the Ethertype field of the ethernet frame.help + man
--data hexThis option lets you include binary data as payload in sent packets.help + man
--data-string textThis option lets you include a regular string as payload in sent packets.help + man
--data-length lenThis option lets you include len random bytes of data as payload in sent packets.help + man
--echo-client passphrase: Run Nping in client mode.help
--echo-server passphrase: Run Nping in server mode.help
--echo-port port: Use custom <port> to listen or connect.help
--no-crypto: Disable encryption and authentication.help
--once: Stop the server after one connection.help
--safe-payloads: Erase application data in echoed packets.help
--delay timeThis option lets you control for how long will Nping wait before sending the next probe.help + man
--rate rateThis option specifies the number of probes that Nping should send per second.help + man
-h, --help (DisplayDisplays help information and exits.help + man
-V, --version (DisplayDisplays the program's version number and quits.help + man
-c, --count nThis option lets you specify the number of times that Nping should loop over target hosts (and in some cases target ports).help + man
-e, --interface nameThis option tells Nping what interface should be used to send and receive packets.help + man
-H, --hide-sent (DoThis option tells Nping not to print information about sent packets.help + man
-N, --no-capture (DoThis option tells Nping to skip packet capture.help + man
--privileged (AssumeTells Nping to simply assume that it is privileged enough to perform raw socket sends, packet sniffing, and similar operations that usually require special privileges.help + man
--unprivileged (AssumeThis option is the opposite of --privileged.help + man
--send-eth (UseAsks Nping to send packets at the raw ethernet (data link) layer rather than the higher IP (network) layer.help + man
--send-ip (SendAsks Nping to send packets via raw IP sockets rather than sending lower level ethernet frames.help + man
--bpf-filter filterThis option lets you use a custom BPF filter.help + man
-v, --verbose levelIncreases the verbosity level, causing Nping to print more information during its execution.help + man
-d levelWhen even verbose mode doesn't provide sufficient data for you, debugging is available to flood you with much more! As with the -v, debugging is enabled with a command-line flag -d and the debug…help + man
-q, --reduce-verbosity levelDecreases the verbosity level, causing Nping to print less information during its execution.help + man
--quiet: Set verbosity and debug level to minimum.help
--debug: Set verbosity and debug to the max level.help

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.