Tping
Guide / packet scripting

Getting started with hping3 workflows.

A focused introduction to interactive packet scripting, Tcl commands, packet descriptions, reception, and repeatable experiments in an authorized lab.

This guide introduces the scripting capabilities associated with hping3. It assumes that you already understand basic command-line use and want to explore how packet descriptions, Tcl control flow, and packet capture fit together.
Before you beginUse packet-generation and packet-reception examples only on systems and networks where you have explicit permission. Start with an isolated lab, keep traffic limited, and record the scope of every test.

First steps

Install a suitable hping3 build from the download page. Raw packet operations commonly require elevated operating-system privileges, so confirm the requirements for your platform and security policy before testing.

Launching hping3 without arguments opens its interactive scripting environment when Tcl support is available:

$ hping3

hping3>

The prompt accepts Tcl commands and adds an hping command for packet-oriented operations. Tcl fundamentals are useful throughout this guide, particularly variables, lists, loops, quoting, and command substitution.

Resolve and describe a target

The hping resolve subcommand converts a host name into an IP address. Keep examples pointed at a permitted lab target and treat returned addresses as environment-specific:

hping3> hping resolve lab-target.example
192.0.2.25

Packet descriptions use APD, a compact syntax for combining protocol layers and fields. The APD reference explains the available structures and values.

Send a controlled packet

The hping send command can transmit a packet assembled from an APD string. This example describes an ICMP echo request without relying on a public host:

hping3> hping send {ip(daddr=192.0.2.25)+icmp(type=8,code=0)}

Unspecified fields may be completed by the tool or the operating system, depending on the protocol and platform. For meaningful analysis, capture the resulting traffic in your permitted test environment and compare the packet you intended to create with the packet that was actually emitted.

Interpretation mattersA successful transmission does not prove reachability, permission, or service availability. Check the capture, response type, timing, route, and filtering behavior together.

Use Tcl to repeat a test

Because the shell is a Tcl interpreter, ordinary Tcl control flow can generate a small, repeatable sequence. This example varies the IPv4 time-to-live field rather than sending an uncontrolled burst:

foreach ttl {5 6 7 8 9 10} {
    hping send "ip(daddr=192.0.2.25,ttl=$ttl)+icmp(type=8,code=0)"
}

Braces preserve the contents of a Tcl word, while double quotes allow variable substitution such as $ttl. For longer experiments, save the script and execute it from the hping3 environment:

$ hping3 exec ttl-test.htcl

Keep the loop bounded, introduce appropriate pacing, and include a clear stop condition. A test script should make its destination, packet count, timing, and expected observation obvious to another operator.

Receive and inspect packets

The hping recv command reads packets from a selected capture interface. Depending on the arguments and local capture setup, it may wait for traffic when the queue is empty:

hping3> hping recv lab0

Returned packets are represented as Tcl list elements in APD format. That makes it possible to select a packet, inspect fields, and use the result in a later operation. The following outline prints a source address and TTL for received IPv4 packets:

while 1 {
    set packet [lindex [hping recv lab0] 0]
    puts "[hping getfield ip saddr $packet] -> [hping getfield ip ttl $packet]"
}

Use hping getfield to extract fields, and consult the receive reference for bounded reads and filter behavior. In production-like environments, avoid logging sensitive payloads or unrestricted packet contents.

Designing a useful experiment

More complex analyses can combine packet generation, reception, field extraction, and a visual or tabular summary. The safest progression is incremental: validate address resolution, send one controlled packet, confirm the capture, then add one variable at a time.

  1. Define the authorized systems, interface, protocol, timing, and stop conditions.
  2. Choose a single measurable question, such as how a route or filter handles a specific header value.
  3. Record the command, tool version, operating-system context, capture result, and timing.
  4. Compare expected and observed behavior before changing the next variable.

Older examples may reference historical operating systems, interfaces, or command syntax. Treat them as learning material and verify every detail against your current build and environment.

Continue with the references

Use the hping3 API for command details, review Tcl notes for scripting concepts, and return to the TCP/IP reference when a packet field or response requires more context. The hping3 overview provides broader background.

For corrections or compatibility observations, contact the Tping editorial mailbox without sending credentials, private captures, or confidential network details.

Help improve the technical record.

Send corrections, compatibility observations, and documentation questions. Do not include credentials, private captures, or confidential network details.

Contact Tping