Netcat

What is Netcat?

Netcat (the nc command) is a tiny, versatile network utility known as the "TCP/IP Swiss Army knife". Its job is simple but powerful: it reads and writes data across network connections using TCP or UDP. From that basic idea you can check whether a port is open, talk directly to a service, transfer files between two machines, stand up a small server that listens on a port, or chain Netcat with other commands through pipes.

There are several implementations: the "traditional" Netcat, the OpenBSD version (common on Debian/Ubuntu and Kali), and Ncat, the modern version from the Nmap project with TLS encryption and more options. Some options differ between them, so if a command does not work, check which one you have with nc -h.

What Netcat is used for

• Network diagnostics: quickly checking whether a port responds without installing anything else.
• Banner grabbing: identifying which service and version runs on a port.
• Simple file transfer between two machines in your lab.
• Protocol debugging: sending HTTP, SMTP or similar requests by hand to understand them.
• Client-server testing and chats: standing up one end that listens and another that connects in seconds.

Netcat is a neutral network tool. Use it to diagnose and learn on your own machines, in labs or on systems you have written authorisation for. Connecting to or scanning other people's machines without permission can be illegal.

How to install Netcat

On most Linux systems it is already installed. If not, on Debian, Ubuntu or Kali:

sudo apt install netcat-openbsd

For the TLS-capable version from the Nmap project:

sudo apt install ncat

On macOS it is usually included; with Homebrew you can install nmap to get ncat. On Windows, the recommended way is to install Nmap, which includes ncat.exe. Check the install with nc -h or ncat --version.

How to use Netcat: practical examples

All examples assume your own or lab machines.

Check whether a port is open

nc -zv 10.0.0.5 22

-z only checks (sends no data) and -v shows the result. You can also test a range:

nc -zv 10.0.0.5 20-25

For thorough port work Netcat falls short of a dedicated scanner like Nmap; use it for quick checks.

Banner grabbing

Connect to a service and see what it announces:

nc 10.0.0.5 22

Many services reply with a banner (SSH, FTP, SMTP version...). For a web server you can request the headers by hand:

printf 'HEAD / HTTP/1.0\r\n\r\n' | nc 10.0.0.5 80

Stand up a listener and connect

On one machine, make Netcat listen on a port:

nc -lvnp 4444

And from the other, connect to it:

nc 10.0.0.10 4444

Whatever you type at one end appears at the other: a two-way text channel, ideal for testing connectivity or as a mini chat. The options mean: -l listen, -v verbose, -n no DNS resolution, -p port.

Transfer a file

On the receiving machine:

nc -lvnp 4444 > received.zip

On the sending machine:

nc 10.0.0.10 4444 < file.zip

When it finishes, close the connection. To confirm it arrived intact, compare the hashes on both sides:

sha256sum file.zip received.zip

Talk to a web server by hand

printf 'GET / HTTP/1.1\r\nHost: 10.0.0.5\r\nConnection: close\r\n\r\n' | nc 10.0.0.5 80

Seeing the raw HTTP response is a great way to understand how the protocol works.

Pro tips

• For TLS, use Ncat: ncat --ssl host 443 lets you talk to encrypted services, which classic Netcat cannot.
• Always verify transferred files with sha256sum: Netcat does not check integrity on its own.
• Beware of -e: many modern builds removed the option that runs a program on connect, precisely because it was abused. If your version lacks it, that is normal.
• Combine it with pipes: Netcat shines chained with tar, printf or gzip for quick streams between your machines.
• For serious scanning, use Nmap: Netcat is for quick checks, not for auditing thousands of ports.
• Note the port and IP: on a listener, -n avoids DNS waits and makes output clearer.

Pros and cons

Pros	Cons
Tiny, fast and almost always available	No encryption in the classic version
Very versatile: ports, transfers, listeners	Options differ between implementations
Perfect for learning low-level TCP/IP	Does not verify data integrity
Combines beautifully with shell pipes	As a scanner, inferior to dedicated tools

Netcat alternatives

• Ncat (Nmap project): the modern successor, with TLS, proxies and more options.
• socat: more powerful and flexible for redirecting and manipulating data streams.
• Nmap: for large-scale port and service scanning and discovery.
• To audit web applications thoroughly, a proxy like Burp Suite or OWASP ZAP.

Frequently asked questions

Is Netcat free?

Yes. It is free software, included in or available from the repositories of virtually every Linux distribution and on macOS; on Windows you get it with Nmap (Ncat).

What is the difference between nc and ncat?

nc is the classic (or OpenBSD) Netcat; ncat is the Nmap-project reimplementation, with TLS encryption, proxy support and extra options. For almost anything modern, Ncat is the better choice.

Is it legal to use Netcat?

The tool is legal; the use is up to you. Connect to and scan only your own machines, labs or systems with written authorisation.

Why does my Netcat lack the -e option?

Many distributions build Netcat without the program-execution option for security reasons. That is expected; if you need it in your own lab, Ncat or socat offer documented alternatives.

Is Netcat good for transferring large files?

It works, but with no encryption and no integrity check. For anything serious between your machines, compare hashes afterwards or use scp/rsync over SSH.

If you want to practise networking and services in controlled environments, the Hackers en Acción Academy has guided labs and challenges.