Nping supports a wide variety of protocols. Although in some cases
Nping can automatically determine the mode from the options used, it
is generally a good idea to specify it explicitly.
--tcp-connect (TCP Connect mode)
TCP connect mode is the default mode when a user does not have
raw packet privileges. Instead of writing raw packets as most
other modes do, Nping asks the underlying operating system to
establish a connection with the target machine and port by
issuing the connect system call. This is the same high-level
system call that web browsers, P2P clients, and most other
network-enabled applications use to establish a connection.
It is part of a programming interface known as the Berkeley
Sockets API. Rather than read raw packet responses off the wire,
Nping uses this API to obtain status information on each
connection attempt. For this reason, you will not be able to
see the contents of the packets that are sent or received but
only status information about the TCP connection establishment
--tcp (TCP mode)
TCP is the mode that lets users create and send any kind of TCP
packet. TCP packets are sent embedded in IP packets that
can also be tuned. This mode can be used for many different
purposes. For example you could try to discover open ports by
sending TCP SYN messages without completing the three-way
handshake. This technique is often referred to as half-open
scanning, because you don't open a full TCP connection.
You send a SYN packet, as if you are going to open a real
connection and then wait for a response. A SYN/ACK indicates
the port is open, while a RST indicates it's closed. If no
response is received one could assume that some intermediate
network device is filtering the responses. Another use could be
to see how a remote TCP/IP stack behaves when it receives a
non-RFC-compliant packet, like one with both SYN and
RST flags set. One could also do some evil by creating custom
RST packets using an spoofed IP address with the intent of
closing an active TCP connection.
--udp (UDP mode)
UDP mode can have two different behaviours. Under normal
circumstances, it lets users create custom IP/UDP packets.
However, if Nping is run by a user without raw packet privileges
and no changes to the default protocol headers are requested,
then Nping enters the unprivileged UDP mode which basically sends
UDP packets to the specified target hosts and ports using the
sendto system call. Note that in this unprivileged mode it is
not possible to see low-level header information of the packets
on the wire but only status information about the amount of bytes
that are being transmitted and received. UDP mode can be used to
interact with any UDP-based server. Examples are DNS servers,
streaming servers, online gaming servers, and
--icmp (ICMP mode)
ICMP mode is the default mode when the user runs Nping with
raw packet privileges. Any kind of ICMP message can be created.
The default ICMP type is Echo, i.e., ping. ICMP mode can be used
for many different purposes, from a simple request for a
timestamp or a netmask to the transmission of fake destination
unreachable messages, custom redirects, and router
--arp (ARP/RARP mode)
ARP lets you create and send a few different ARP-related packets.
These include ARP, RARP, DRARP, and InARP requests and replies.
This mode can ban be used to perform low-level host discovery,
and conduct ARP-cache poisoning attacks.
--traceroute (Traceroute mode)
Traceroute is not a mode by itself but a complement to
TCP, UDP, and ICMP modes. When this option is specified Nping
will set the IP TTL value of the first probe to 1. When the
next router receives the packet it will drop it due to
the expiration of the TTL and it will generate an ICMP
destination unreachable message. The next probe will have a TTL
of 2 so now the first router will forward the packet while the
second router will be the one that drops the packet and
generates the ICMP message. The third probe will have a TTL value
of 3 and so on. By examining the source addresses of all
those ICMP Destination Unreachable messages it is possible to
determine the path that the probes take until they reach their