It can just be done by adding -traceroute to the last command. Traceroute to a determined port: A nice feature from Hping3 is that you can do a traceroute to a specified port watching where your packet is blocked. We can control also from which local port will start the scan (5050). Checking port: Here hping3 will send a Syn packet to a specified port (80 in our example). Traceroute using ICMP: This example is similar to famous utilities like tracert (windows) or traceroute (linux) who uses ICMP packets increasing every time in 1 its TTL value. Testing ICMP: In this example hping3 will behave like a normal ping utility, sending ICMP-echo und receiving ICMP-replyĢ. apd-send Send the packet described with APD (see docs/APD.txt) tr-no-rtt Don't calculate/show RTT information in traceroute mode tr-keep-ttl Keep the source TTL fixed, useful to monitor just one hop tr-stop Exit when receive the first not ICMP in traceroute mode T -traceroute traceroute mode (implies -bind and -ttl 1)

u -end tell you when -file reached EOF and prevent rewind

tcp-timestamp enable the TCP timestamp option to guess the HZ/uptime tcpexitcode use last tcp->th_flags as exit code So you'll get bad UDP/TCP checksum instead. Many systems will fix the IP checksum sending the packet b -badcksum (try to) send packets with a bad IP checksum Q -seqnum shows only tcp sequence number O -tcpoff set fake tcp data offset (instead of tcphdrlen / 4) p -destport destination port(default 0) ctrl+z inc/dec s -baseport base source port (default random) icmp-help display help for others icmp options icmp-addr Alias for -icmp -icmptype 17 (ICMP address subnet mask) icmp-ts Alias for -icmp -icmptype 13 (ICMP timestamp) icmp-gw set gateway address for ICMP redirect (default 0.0.0.0) force-icmp send all icmp types (default send only supported types) C -icmptype icmp type (default echo request) H -ipproto set the IP protocol field, only in RAW IP mode ssrr strict source routing and record route lsrr loose source routing and record route G -rroute includes RECORD_ROUTE option and display the route buffer o -tos type of service (default 0x00), try -tos help m -mtu set virtual mtu, implies -frag if packet size > mtu r -rel relativize id field (to estimate host traffic) rand-dest random destionation address mode. beep beep for every matching packet receivedĮxample: hping -scan 1-30,70-90 -S -9 -listen listen mode z -bind bind ctrl+z to ttl (default to dst port) I -interface interface name (otherwise default routing interface) faster alias for -i u1000 (100 packets for second) fast alias for -i u10000 (10 packets for second) i -interval wait (uX for X microseconds, for example -i u1000) Or you can invoke help menu with the -help hping3 -help You can read the manpage for hping by typing Regardless of which Hping you get, the command to flood a target is as follows:

Hping3 usage