Crafting ICMP echo replies with Nping

Nping is a utility designed to ease the process of crafting network packets. It is very useful to debug and troubleshoot network communications and perform traffic analysis.

This recipe will introduce Nping and go over the process of crafting and transmitting custom ICMP packets.

How to do it...

Let's say that we want to respond to an ICMP echo request packet with an echo reply using Nping. Consider that the first ICMP echo request packet has a source IP of 192.168.0.10 with an ICMP ID of 520, and the data string was the word ping. With that information, we can craft the reply with the following command:

#nping --icmp -c 1 --icmp-type 0 --icmp-code 0 --source-ip192.168.0.5 --dest-ip 192.168.0.10 --icmp-id 520 --icmp-seq 0--data-string 'ping'  

In the output, you should see the sent ICMP echo reply packet with the values taken from the ICMP echo request packets:

   SENT (0.0060s) ICMP [192.168.0.5 > 192.168.0.10 Echo reply    
   (type=0/code=0) id=520 seq=0] IP [ttl=64 id=10898 iplen=32 ] 
   Max rtt: N/A | Min rtt: N/A | Avg rtt: N/A 
   Raw packets sent: 1 (32B) | Rcvd: 0 (0B) | Lost: 1 (100.00%) 
   Nping done: 1 IP address pinged in 1.01 seconds 

How it works...

Nping allows configuring the values of most fields in TCP, UDP, ARP, and ICMP packets easily. The following command will send an ICMP echo reply packet with the values obtained from the ICMP echo request packet:

#nping --icmp -c 1 --icmp-type 0 --icmp-code 0 --source-ip192.168.0.5 --dest-ip 192.168.0.10 --icmp-id 520 --icmp-seq 0 --data-string 'ping'  

Let's break it down by its arguments:

• --icmp: This sets ICMP as the protocol to use.
• -c 1: Packet count. Send only one packet.
• --icmp-type 0 --icmp-code 0: This sets ICMP type and code. This type corresponds to an echo reply message.
• --source-ip 192.168.0.5 --dest-ip 192.168.0.10: This sets the source and destination IP address.
• --icmp-id 520: This sets the ICMP identifier of the request packet.
• --icmp-seq 0: This sets the ICMP Sequence number.
• --data-string 'ping': This sets the data string.

There's more...

Nping can set most fields in TCP, UDP, ARP, and ICMP packets via arguments but offers a lot more customization than we offer. In addition to the interesting timing and performance options, Nping supports a mode named echo that is handy when troubleshooting firewall or routing issues. I highly recommend you go over the documentation at https://nmap.org/nping/ to become familiar with this powerful tool and the scenarios where it can be handy.