netcat Cheatsheet - Network Debugging

The most common netcat workflow is confirming reachability without any listening service — `nc -zv host port` returns cleanly per port and `-w` stops it hanging on a black-hole drop. Pair that with `-l` to build a one-shot listener and the -z/-v/-w flags to bound each probe, and most "is it open / does it respond" questions settle in one line.

SysOps·36 commands·Last updated 2026-07-21

Connectivity Test & Port Scan 6

nc -zv host 80

Check if port 80 is open (most common)

nc -zv host 80 443 8080

Check multiple specified ports

nc -zv host 1-1000

Scan ports 1-1000

nc -vz -w 2 host 80

Port check with a 2-second timeout

nc -uz host 8080

UDP mode port check

nc -4 host 80

Force IPv4 connection

File & Data Transfer 6

nc -l 9999 > received.txt

Receiver: listen and save to a file

nc host 9999 < file.txt

Sender: send a file

tar czf - dir | nc host 9999

Sender: package and send a directory

nc -l 9999 | tar xzf -

Receiver: receive and extract

dd if=/dev/sda | nc host 9999

Sender: transfer a disk image

nc host 9999 | pv > disk.img

Receiver: receive image with a progress bar (needs pv)

Port Listening 5

nc -l 8080

Listen on local port 8080 for connections

nc -l -p 8080

Listen (old nc syntax, needs -p)

nc -l -k 8080

Keep listening, accept multiple connections (BSD)

nc -lk 8080

Same as above, combined form

nc -lu 9090

Listen on a UDP port

Proxy & Forwarding 3

nc -l 1234 | nc target 80

Simple TCP proxy/forward

mkfifo pipe; nc -lk 8080 < pipe | nc target 80 > pipe

Bidirectional port forward (pipe method)

nc -l 1234 -e /bin/bash

Bind a shell to a port (GNU nc; authorized testing only)

Advanced Options & Flags 7

-v / -vv

Verbose / more verbose output

-z

Zero-I/O mode: scan only, send no data

-w 2

2-second connection timeout

-k

Keep listening, accept multiple connections (BSD)

-s 192.168.1.1

Specify the source IP address

-p 12345

Specify the local source port

-u

Use the UDP protocol

Alternatives & Comparison 4

ncat host 80

Nmap's ncat; supports SSL and access control

ncat --ssl host 443

ncat encrypted connection, replaces plain nc

socat - TCP:host:80

socat: a more powerful alternative, more protocols

nc --version

Check nc version (BSD/GNU/OpenBSD)

Tips

macOS ships BSD nc, whose flags differ from GNU ncat — take care when troubleshooting.
Port scanning is only for authorized network checks; unauthorized scanning is a violation.
nc transfers are unencrypted; don't send sensitive data directly — use SSH or TLS.
OpenBSD nc lacks -e; use ncat or socat when you need to bind a shell.
For large files, show progress on the sender with pv file.txt | nc host 9999.
For port forwarding, prefer socat or ncat — more complete and with persistent connections.

Official References

Each command links to its official documentation below, so you can verify the latest usage and read deeper.

Nmap/Ncat Docs

Maintained by LaoHand

Publicly updated on Jul 21, 2026, continuously proofread against official docs.

Contact Us

Wrong command or description? Send us corrections, business inquiries or product feedback by email.