How it works...
To effectively use hping3 for layer 3 discovery, a bash script was used to perform an ICMP echo request in sequence. This was possible due to the unique response that was generated by a successful and unsuccessful request. By passing the function through a loop and then grepping for the unique response, we could effectively develop a script that performs ICMP discovery against multiple systems in sequence and then outputs a list of live hosts.
For layer 4 discovery, hping3 uses ICMP host-unreachable responses to identify live hosts with UDP requests and uses null-flag scanning to identify live hosts with TCP requests. For UDP discovery, a series of null UDP requests is sent to arbitrary destination ports in an attempt to solicit ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access