Network Diagnostics for Security Teams: ping, hping3, and traceroute
Before you can secure a network, you need to see what's actually happening on it — which hosts respond, which ports are open, and how firewall rules behave under real traffic. ping and hping3 are two of the oldest tools for this, and still two of the most useful — one for basic reachability, the other for crafting the exact packet you need to answer a specific question.
Basic reachability with ping
Standard ping sends ICMP echo requests and measures round-trip time. It's the fastest first check for "is this host up," though many cloud firewalls and security groups block ICMP by default — a failed ping doesn't always mean a dead host.
ping-c 410.0.0.15
# Flood interval for stress-testing YOUR OWN test host
ping-i 0.2 -c 5010.0.0.15
# Check with a specific packet size (test MTU / fragmentation)
ping-M do -s 147210.0.0.15
Testing firewall rules with hping3
Where ping only speaks ICMP, hping3 can craft TCP and UDP packets with specific flags and ports — exactly what you need to verify a firewall rule actually does what it claims.
hping3-S -p 443 -c 310.0.0.15
# Scan a small range of ports (simple, sequential — not a full port scan)
hping3-S -p ++20 -c 2010.0.0.15
# ACK scan — useful for mapping stateful vs stateless firewall behavior
hping3-A -p 80 -c 310.0.0.15
# UDP probe for a specific service port
hping3-2 -p 53 -c 310.0.0.15
Tracing the path with traceroute
When a host is unreachable, traceroute shows exactly which hop the traffic is dying at — useful for telling a routing problem apart from a firewall drop.
traceroute10.0.0.15
# TCP traceroute on a specific port — bypasses ICMP-only blocks
traceroute-T -p 44310.0.0.15
# hping3 equivalent, one TTL at a time
hping3-S -p 443 -t 1 -c 110.0.0.15
Detecting this activity on your own infrastructure
The same techniques that verify your defenses are what an attacker's early reconnaissance looks like. Watching for this pattern is part of the job, not just running the probes.
Need help hardening a network's edge, or want an authorized penetration test against your own infrastructure before an attacker finds the gaps first? This is exactly the kind of work I do as part of Cybersecurity services engagements.