Ping

ICMP, or Internet Control Message Protocol, does not use ports like TCP and UDP.

|200x200

Echo Ping

nmap

ICMP Ping Scan

Like -sn but only ICMP Echo requests are used

nmap -sn -PE 192.168.60.130

hping3

ICMP Scan

hping3 -1 10.0.0.25

Timestamp Ping

ICMP Timestamp Ping

  • Nmap sends an ICMP timestamp request to the target.
  • If the target responds with an ICMP timestamp reply, it confirms the host is online
  • Useful when standard ICMP Echo Requests (-PE) are blocked but timestamp requests are allowed.
nmap -sn -PP 192.168.60.130

TCP Timestamping

Many firewalls drop those TCP packets that do not have the TCP Timestamp option set. By adding the --tcp-timestamp argument in the command line, you can enable the TCP timestamp option in Hping and try to guess the timestamp update frequency and uptime of the target host (72.14.207.99).

hping3 -S 72.14.207.99 -p 80 --tcp-timestamp

Address mask ping

ICMP Address mask Ping

ICMP Address Mask Ping Scan

  • Address mask ping is another alternative to the traditional ICMP ECHO ping
  • Attackers send an ICMP address mask query to the target host to acquire information related to the Subnet Mask
  • The address mask response from the destination host is conditional
    • it may or may not respond with the appropriate subnet value depending on its configuration by the administrator at the target’s end
  • This type of ping method is also effective in identifying the active hosts similarly to the ICMP timestamp ping
  • the -PM option is used to perform an ICMP address mask ping scan.
nmap -sn -PM 10.10.1.13