LaoHandDeveloper Cheatsheet

netcat Cheatsheet - Port Scan, Listen & Netcat Examples

When you need to know whether a port answers, netcat gives you the shortest path: nc -zv host 80 returns per-port results, and adding -w bounds the wait so a black-holed host cannot hang the check. Its limits matter just as much. nc moves bytes over TCP or UDP without understanding the protocol above them and without encrypting anything. Reading an HTTP response header is fine; moving credentials through it is not, and that traffic belongs on SSH or TLS. Version drift causes the rest of the confusion, since the nc shipped on macOS is the BSD variant with a different flag set, and the OpenBSD build has no -e, pushing you to ncat or socat for shell binding and forwarding. Sections cover connection tests and port checks, file and data transfer, listening, proxying and forwarding, banner grabbing and protocol debugging, advanced options, and alternatives. A useful habit is to escalate from TCP connect to an actual protocol request, since an open port only proves a listener exists, not that the service answers correctly.

SysOps·36 commands·Last updated 2026-07-21
netcatncNetworkingPorts

Connectivity Test & Port Scan 6

nc -zv host 80
Check if port 80 is open (most common)
nc -zv host 80 443 8080
Check multiple specified ports
nc -zv host 1-1000
Scan ports 1-1000
nc -vz -w 2 host 80
Port check with a 2-second timeout
nc -uz host 8080
UDP mode port check
nc -4 host 80
Force IPv4 connection

File & Data Transfer 6

nc -l 9999 > received.txt
Receiver: listen and save to a file
nc host 9999 < file.txt
Sender: send a file
tar czf - dir | nc host 9999
Sender: package and send a directory
nc -l 9999 | tar xzf -
Receiver: receive and extract
dd if=/dev/sda | nc host 9999
Sender: transfer a disk image
nc host 9999 | pv > disk.img
Receiver: receive image with a progress bar (needs pv)

Port Listening 5

nc -l 8080
Listen on local port 8080 for connections
nc -l -p 8080
Listen (old nc syntax, needs -p)
nc -l -k 8080
Keep listening, accept multiple connections (BSD)
nc -lk 8080
Same as above, combined form
nc -lu 9090
Listen on a UDP port

Proxy & Forwarding 3

nc -l 1234 | nc target 80
Simple TCP proxy/forward
mkfifo pipe; nc -lk 8080 < pipe | nc target 80 > pipe
Bidirectional port forward (pipe method)
nc -l 1234 -e /bin/bash
Bind a shell to a port (GNU nc; authorized testing only)

Advanced Options & Flags 7

-v / -vv
Verbose / more verbose output
-z
Zero-I/O mode: scan only, send no data
-w 2
2-second connection timeout
-k
Keep listening, accept multiple connections (BSD)
-s 192.168.1.1
Specify the source IP address
-p 12345
Specify the local source port
-u
Use the UDP protocol

Alternatives & Comparison 4

ncat host 80
Nmap's ncat; supports SSL and access control
ncat --ssl host 443
ncat encrypted connection, replaces plain nc
socat - TCP:host:80
socat: a more powerful alternative, more protocols
nc --version
Check nc version (BSD/GNU/OpenBSD)

Command Examples

Quickly test whether a port is open

nc -zv example.com 443 2>&1

-z 是零 I/O 模式只探测不发送数据，-v 输出结果。只对你有权测试的主机使用，端口扫描需先取得授权。

Output

nc: connect to example.com port 443 (tcp) succeeded! Connection to example.com 443 port [tcp/https] succeeded!

Grab a service banner to identify the version

echo "" | nc -w 2 example.com 22

很多服务连上就先发一行版本信息。-w 2 设 2 秒超时，否则连到不响应的端口会一直挂着。

Output

SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.5

Send a raw HTTP request for debugging

printf "GET / HTTP/1.1\r\nHost: example.com\r\nConnection: close\r\n\r\n" | nc example.com 80

直接发原始报文能验证 curl 之外的协议层行为。注意 CRLF 行尾，手写成 \n 在严格的服务端会解析失败。

Output

HTTP/1.1 200 OK
Date: Wed, 30 Sep 2026 07:20:11 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 1256

<!doctype html>...

Common Pitfalls

  • nc -l -e /bin/bash binds a shell to a port — the classic reverse-shell technique. Use it only on your own machine in authorized testing.
  • Port scanning requires prior written authorization; unauthorized scanning is illegal in many jurisdictions.
  • nc flags differ across BSD/GNU/OpenBSD versions; older builds need -p for listening. Check nc --version first.
  • File transfer over plain nc has no encryption or integrity checking — use SSH for anything sensitive.
  • A bare nc -l exposes an unauthenticated listener to everyone who can reach the port.

Tips

  • macOS ships BSD nc, whose flags differ from GNU ncat — take care when troubleshooting.
  • Port scanning is only for authorized network checks; unauthorized scanning is a violation.
  • nc transfers are unencrypted; don't send sensitive data directly — use SSH or TLS.
  • OpenBSD nc lacks -e; use ncat or socat when you need to bind a shell.
  • For large files, show progress on the sender with pv file.txt | nc host 9999.
  • For port forwarding, prefer socat or ncat — more complete and with persistent connections.

Related Cheatsheets

6 related cheatsheets

Linux Troubleshooting Cheatsheet - System Fault Diagnosis Command ReferenceA one-stop Linux troubleshooting reference organized by process/load, port/network, disk/memory, and logs/services, helping you quickly spot performance bottlenecks, connection anomalies, and resource hogs during live incidents.Vim Cheatsheet - Modes, Editing & Search CommandsA Vim operation reference covering cursor motion, text editing, search and replace, visual mode, and save/exit, aimed at developers and operators editing files on a server, including real-world tricks such as batch replacement and saving with sudo.Systemd Cheatsheet - Systemd Service Management Command ReferenceA Systemd service-management reference covering start/stop and boot-enabling, journalctl log viewing, timer scheduling, targets and runlevels, and resource limits, with the differences between easily-confused pairs such as reload vs restart and mask vs disable.Cron Cheatsheet - Cron Expression & Task Scheduling ReferenceA Cron scheduling reference spanning the 5-field expression format, special characters and time macros, common examples, environment variables, and troubleshooting, flagging frequent pitfalls such as the OR relationship between day-of-month and day-of-week and the minimal default PATH.CI/CD Commands Cheatsheet - CI/CD Pipeline Debugging ReferenceA debugging reference for GitHub Actions, GitLab CI, and Jenkins pipelines, covering job reruns and log extraction, runner online status, cache and disk usage, and local reproduction with act or gitlab-runner exec.MQ Commands Cheatsheet - Kafka/RabbitMQ/RocketMQ ReferenceAn MQ operations reference for Kafka, RabbitMQ, RocketMQ, and Redis Pub/Sub, focused on the four high-frequency scenarios of locating consumer backlog, hunting connection leaks, diagnosing cluster state, and benchmarking throughput.

Official References

Each command links to its official documentation below, so you can verify the latest usage and read deeper.

Maintained by LaoHand

Publicly updated on Jul 21, 2026, continuously proofread against official docs.

Contact Us

Wrong command or description? Send us corrections, business inquiries or product feedback by email.

Contact Us