nping: add docs about --badsum for ICMP

This commit is contained in:
Slava Bacherikov 2026-01-11 11:29:52 +02:00
parent c4bdee677c
commit 28a64a848f
3 changed files with 25 additions and 0 deletions

View file

@ -1049,6 +1049,23 @@ SENT (4.0330s) TCP 192.168.0.21 > 3.3.3.3:139
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>--badsum</option> (Invalid Checksum)
<indexterm significance="preferred"><primary><option>--badsum</option> (Nping option)</primary></indexterm>
</term>
<listitem>
<para>
Asks Nping to use an invalid ICMP checksum for the packets sent to
target hosts. Since virtually all host IP stacks properly drop these
packets, any responses received are likely coming from a firewall or
an IDS that didn't bother to verify the checksum. For more
details on this technique, see
<ulink url="https://nmap.org/p60-12.html"/>.
</para>
</listitem>
</varlistentry>
</variablelist>
<refsect2 id="nping-man-icmp-types">

View file

@ -39,6 +39,7 @@ ICMP PROBE MODE:
--icmp-orig-time <timestamp> : Set originate timestamp.
--icmp-recv-time <timestamp> : Set receive timestamp.
--icmp-trans-time <timestamp> : Set transmit timestamp.
--badsum : Use a random invalid checksum.
ARP/RARP PROBE MODE:
--arp-type <type> : Type: ARP, ARP-reply, RARP, RARP-reply.
--arp-sender-mac <mac> : Set sender MAC address.

View file

@ -131,6 +131,7 @@ ICMP PROBE MODE:
\-\-icmp\-orig\-time <timestamp> : Set originate timestamp\&.
\-\-icmp\-recv\-time <timestamp> : Set receive timestamp\&.
\-\-icmp\-trans\-time <timestamp> : Set transmit timestamp\&.
\-\-badsum : Use a random invalid checksum\&.
ARP/RARP PROBE MODE:
\-\-arp\-type <type> : Type: ARP, ARP\-reply, RARP, RARP\-reply\&.
\-\-arp\-sender\-mac <mac> : Set sender MAC address\&.
@ -678,6 +679,12 @@ This option sets the Transmit Timestamp in ICMP Timestamp messages\&. The Transm
is as with
\fB\-\-icmp\-orig\-time\fR\&.
.RE
.PP
\fB\-\-badsum\fR (Invalid Checksum)
.RS 4
Asks Nping to use an invalid ICMP checksum for the packets sent to target hosts\&. Since virtually all host IP stacks properly drop these packets, any responses received are likely coming from a firewall or an IDS that didn\*(Aqt bother to verify the checksum\&. For more details on this technique, see
\m[blue]\fB\%https://nmap.org/p60-12.html\fR\m[]\&.
.RE
.SS "ICMP Types"
.PP
These identifiers may be used as mnemonics for the ICMP type numbers given to the