# WHATPORT(9929)

## NAME

port 9929 — Nping echo server — Nmap's Nping echo server — it shows you exactly how NAT and firewalls rewrote your packets in transit.

Protocol: TCP  
IANA registry

## DESCRIPTION

Nping's echo mode splits into a server and a client: the client sends crafted probe packets to the server, the server captures them off the wire and sends verbatim copies back over a separate encrypted TCP side channel using the Nping Echo Protocol. Comparing sent and echoed packets makes NAT rewrites, traffic shapers, and firewalls that strip TCP options immediately visible, and distinguishes "the request was dropped" from "the reply was dropped". The documented default for `--echo-server` is port 9929. It is unassigned at IANA; Nmap's own service database lists it as `nping-echo`, and Nmap's public scanme.nmap.org host has long run one, which is where most people first encounter the port.

## EXPOSURE

**Expose with care.** The channel is encrypted and requires a shared passphrase, and running a public echo server is a deliberate choice Nmap supports. It still lets clients drive packet capture on your host, so run it only when you mean to and shut it down afterwards.

## CHECK

```sh
nping --echo-client "public" TARGET --tcp -p 80
```

## SEE ALSO

- docs — [Nping Reference Guide — Echo Mode (default port 9929)](https://nmap.org/book/nping-man.html) (nmap.org)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/9929/> · JSON: <https://whatport.net/9929.json> · full dataset: <https://whatport.net/ports.json>