Advanced Ping: httping, dnsping, smtpping

http://blog.webernetz.net/2016/05/10/advanced-ping-httping-dnsping-smtpping/

by jonbaer • 10 years ago

109 39 10 years ago

blog.webernetz.net

kyberias• 10 years ago

Why the inconsistent naming? Why is it httping and smtpping? Why not httpping?

imdsm• 10 years ago

This got me as well.

dkopi7• 10 years ago

Different people creating different tools

merb• 10 years ago

actually the naming is bad anyway. the initial implementation only was used to check if a host is reachable (routing etc) inside a network. then later other stuff came in like RTT. however a ping on a higher layer is mostly not a "real" ping. since it tests way more than just reachability. i.e. a http also checks connectivity and when it comes to domains it even includes a dns check.

Programmatic2• 10 years ago

Ping has confounding factors as well (firewall blocks, DNS, etc). If it works then you know that it's IP reachable, reachable on that TCP port, and that there's a responsive daemon on the other end. If it doesn't, you know that you need to troubleshoot. A device could not ICMP echo request ping, but respond to httping. Neither is perfect.

dkopi7• 10 years ago

TLDR: A lot of companies block ICMP for security reasons. OP thinks you shouldn't and provides links explaining why. That said, if ICMP is still blocked, you might be able to use httping, dnsping and smtpping as tools that provide similar information based on a server's responses to higher layered protocols.

INTPenis5• 10 years ago

I'm not a network architect but I like it when ICMP is blocked because I know it can be used to tunnel traffic in penetration situations.

dkopi7• 10 years ago

Any type of traffic can be used to tunnel other types of traffic.

You can tunnel over DNS as well: https://zeltser.com/c2-dns-tunneling/

moonfern• 10 years ago

With iptables you can read packets, is it an icmp packet, what is it length and so on... If I was a hacker and I notice that icmp packets are blocked, I would feel less fear.

belorn• 10 years ago

Effective security know what assets they are defending, what threat exist, and what the cost benefit is of applying a defensive measure to prevent the threats. Assuming that you have identified some assets you want to protect, is the threat that someone might tunnel traffic outside of monitored channels?

If yes, again assuming that all traffic is either monitored or blocked, have you done cost-benefit of monitoring ICMP for tunneled traffic vs blocking? A blocking rule need to be maintained, and it prevents diagnostics tools. If you have or will have a outside service that use heartbeat, such usage require whitelisting and maintenance for handling the permissions. In contrast, monitoring ICMP should just involve the same work as adding an additional protocol to the existing monitoring system.

One should also give some thought to the most common forms that adversaries use to tunnel traffic. TCP port 80 and 441 is a commonly used method to break through firewalls and nat, since those are considered outgoing ports which companies can't afford to block. (a small remark, where I work we do block those ports in some situations, and it has caught several intruders). Ports used for email is of course even more common to see malicious use from, and it is not uncommon that ISPs block all outgoing traffic on those ports. No one should consider blocking ICMP at all unless the more common traffic channels are monitored or blocked, unless they just want to create a false sense of security.

NetStrikeForce• 10 years ago

This is often said by people that do not understand that ICMP is not only echo/reply.

There are countless other situations where you want to receive an ICMP: e.g. "TTL expired" or "Fragmentation needed but DF bit set".

13of402• 10 years ago

I wrote a tool a long time back for testing PowerShell remoting connections that started with name resolution, then tried ICMP, TCP, HTTP, WinRM, etc. to figure out what layer was failing. Ping was critical to start out with because if it worked but IP-based protocols failed it was nearly always an IPSec problem. If ping didn't work, it was the firewall.

markbnj• 10 years ago

I just reach for curl in situations where I need a layer 7 request/response to see if things are up. I can see where this might be a little easier, especially for repeated requests.

INTPenis5• 10 years ago

I have an sshping in my ~/bin because I often found myself waiting to log back into a rebooting server and ping starts responding much earlier than ssh.

   #!/bin/bash
   
   while sleep 0.5; do
     nc -vv -w 1 -z ${1:-localhost} ${2:-22}
   done

hk__2• 10 years ago

Why don’t you wait for ssh to respond if you need it to log back?

SteveNuts• 10 years ago

That's what the script is doing, waiting until ssh is available so he can login as soon as it's back responding.

INTPenis5• 10 years ago

I wrote this years ago but I've since then realized I could probably fill the same purpose with autossh.

eik3_de• 10 years ago

waiting to log back into a rebooting server

  $ alias sshammer
  alias sshammer='ssh -o ConnectionAttempts\ 10000 -o ConnectTimeout\ 5'

INTPenis5• 10 years ago

Nice, I was thinking autossh but this is even better. :)

ape4• 10 years ago

It bugs me a bit that "ping" has got into general use. eg "Ping me with an email later".

bramblerose• 10 years ago

'Ping' (the word) is older (as in: 1835 old) than the 'ICMP Ping'.

13of402• 10 years ago

I always thought it came from old fashioned submarine sonar. What would it have meant in 1835?

gumby• 10 years ago

Might not bother you if you could convince yourself that it isn't a metaphorical reference to ping(8) but instead was a reference to a sonar ping, or tossing a pebble at a tank to see how full it is -- to former being where the program got its own name in the first place!

chip_rosenthal• 10 years ago

Why not just use nmap?

  $ nmap -Pn -p domain e.gtld-servers.net

  Starting Nmap 7.01 ( https://nmap.org ) at 2016-05-15 13:32 CDT
  Nmap scan report for e.gtld-servers.net (192.12.94.30)
  Host is up (0.072s latency).
  PORT   STATE SERVICE
  53/tcp open  domain

  Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds

The repeated ping function -- which is intended to display packet loss or delay -- isn't useful for TCP services.

sbierwagen• 10 years ago

I usually just curl -I a host to see if it's accessible.

reader_1000• 10 years ago

There is also paping [1] that lets you "ping" to arbitrary port, although it only works for TCP.

[1] https://code.google.com/archive/p/paping/

Advanced Ping: httping, dnsping, smtpping

Related Stories