This short document is for users of hping-beta54 or prior versions
and helps to exploit all the new features of this hping2 release in a
short time. You may want to read the new man page anyway but the
following will help for sure:

. Now hping works better on BSD, and works on Solaris. It should
  be many times simplest to port it to an unsupported plataform.
  Problems with systems that uses 32bit pids are now fixed.

. The output is different to be more parsable and compact, example:

  len=46 ip=192.168.1.1 flags=RA DF seq=0 ttl=255 id=0 win=0 rtt=0.5 ms

  now the presence of the Don't fragment IP flag is signaled with 'DF'.
  all the fields with a value are in the form 'field=value'.

. To specify the outgoing interface with -I is no longer needed,
  hping will try to detect the right interface according to the
  system routing table. Of course you can override it using -I.

. Insetad to specify -i u10000 to get a speed of ten packets for second
  you can just use --fast.

. Now --traceroute (-T) implies --ttl 1. You can override this using --ttl.

. Using hping as traceroute you have now RTT informations about the
  hops.

. You can monitor a specific hop in traceroute mode, using the following
  syntax:

  hping2 -T www.yahoo.com --tr-keep-ttl --ttl 5

  see the output:

  HPING www.yahoo.com (ippp0 64.58.76.177): NO FLAGS are set, 40 headers + 0 dat
  a bytes
  5->TTL 0 during transit from 144.232.234.57  (sl-gw18-nyc-2-2.sprintlink.net)
  5->RTT was: 136.9 ms
  5->TTL 0 during transit from 144.232.234.57  (sl-gw18-nyc-2-2.sprintlink.net)
  5->RTT was: 136.8 ms
  5->TTL 0 during transit from 144.232.234.57  (sl-gw18-nyc-2-2.sprintlink.net)
  5->RTT was: 136.9 ms
  5->TTL 0 during transit from 144.232.234.57  (sl-gw18-nyc-2-2.sprintlink.net)
  5->RTT was: 136.7 ms

 --- www.yahoo.com hping statistic ---
 4 packets tramitted, 0 packets received, 100% packet loss
 round-trip min/avg/max = 136.7/136.8/136.9 ms

 you get only information about the 5 hop, after Ctrl+C the round-trip
 min/avg/max is calculated using the rtt of this hop.

. Using the option --tr-stop you can obtain that hping will exit
  when the first matching packet that isn't an ICMP time exceeded
  in transit is received, like the original traceroute. Without
  this hping continue to send packets to the target host forever.

. You can use --tr-no-rtt to suppress the rtt information in traceroute
  mode.

. With the --tcp-timestamp feature you can guess the uptime of some
  remote systems. Example:

HPING www.hping.org (ippp0 192.70.106.166): S set, 40 headers + 0 data bytes
56 bytes from 192.70.106.166: flags=SA seq=0 ttl=49 id=28881 win=16080 rtt=105.0 ms
  TCP timestamp: 258597761

56 bytes from 192.70.106.166: flags=SA seq=1 ttl=49 id=28882 win=16080 rtt=105.4 ms
  TCP timestamp: 258597860
  HZ seems 100
  System uptime seems: 29 days, 22 hours, 19 minutes, 38 seconds

56 bytes from 192.70.106.166: flags=SA seq=2 ttl=49 id=28883 win=16080 rtt=105.1 ms
  TCP timestamp: 258597960
  HZ seems 100
  System uptime seems: 29 days, 22 hours, 19 minutes, 39 seconds


--- www.hping.org hping statistic ---
3 packets tramitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 105.0/105.2/105.4 ms

  As you can see the first reply does not contain any uptime information
  since at least two packets are needed to extimante the increment frequence
  of the timestamp timer (that is HZ in the output).

. You can now use ICMP timestamp and address subnet mask requests.
  Two shortcut are provided to use they: --icmp-ts and --icmp-addr.

. Now the sequence number handling is revisited to allow hping to
  show the right rtt info even if the sequence number overflows.

. Now hping should never (hopefully) SIGBUS on sparc.

I hope you will find hping better to use and more powerful, this enhanchments
was implemented thanks to many people that helped a lot with code and
new ideas, see the CHANGES file for more information and credits.

have fun,
antirez
