nping

nping (from the nmap project) sends packets you describe field by field: TCP, UDP, ICMP or ARP, to any address and port, from any source. With --send-eth it builds the whole Ethernet frame itself, so it can also claim any source MAC address: the way to test what a switch or a neighbour does with a frame from a device that does not exist. It needs root, and it waits a second for replies after each packet unless told otherwise.

nping command usage

nping --tcp|--udp|--icmp|--arp [-p PORT] [-c COUNT] [--delay TIME] TARGET
nping --arp --send-eth -e CARD --source-mac MAC [-c COUNT] TARGET

Options

--arp / --tcp / --udp / --icmp

the kind of packet to send

-c 1

send 1 packet (per target) and stop

--send-eth -e eth0

build whole Ethernet frames and send them out of eth0

--source-mac MAC

the source MAC address the frame claims

-p 80

the destination port, for TCP and UDP

-S ADDR

forge the source IP address the packet claims

--rate N

send N packets per second

--data HEX

a raw payload, given as hex bytes

nping examples

nping --tcp -p 80 -c 3 10.0.1.20

Sends three TCP SYNs to port 80 and prints each reply, with its flags.

nping --arp -c1 --send-eth -e eth0 --source-mac 02:00:00:00:00:01 10.0.1.250

Sends one ARP request from a made-up MAC address, which every switch on the way learns.

nping --udp -p 53 -S 10.0.2.13 -c 30 --rate 30 10.0.1.10

Sends thirty DNS queries that forge a victim's source address, so the replies land on the victim.

Pitfalls

• Each run waits about a second for replies: to send many frames quickly, start several at once in the background, or use --delay.
• A frame from a made-up MAC teaches switches a device that does not exist: only do it on a network you run.

Run it on real machines