nc, or netcat, is a small tool that can open network connections and accept them. It is often called a "Swiss army knife" for networking, because a single command can check whether a port is open, send a file to another server or confirm that a firewall lets connections through. In this article we go through the most useful techniques with real examples. We tested all commands on a test server with Debian 12 and netcat-openbsd 1.219.

---

How nc works

Any program that talks over a network does one of two things. It either connects to another computer by address and port, like a browser to a website, or waits for connections on its own port, like a web server. nc can do both, but adds nothing of its own. Everything you type on the keyboard or pass through | it sends to the network as is, and everything that comes from the network it prints on the screen. That is why it is handy for checking and debugging network services, as you see the exchange without intermediaries.

Keep in mind that there are several versions of nc, and their options differ a little. Debian and Ubuntu install netcat-openbsd by default, and the examples below are written for it. If the nc command is missing, install it.

# Debian and Ubuntu
apt update && apt install -y netcat-openbsd

# AlmaLinux and Rocky Linux, where nc comes in the nmap-ncat package
dnf install -y nmap-ncat

---

Main options

• -z checks a port without sending data.
• -v prints details, without it nc stays silent during a check.
• -w 3 waits no longer than 3 seconds for a reply.
• -u switches nc to UDP, by default it works over TCP.
• -l turns on listening for connections on the given port.
• -N closes the connection when the input data runs out. Without it, sending a file may never finish.
• -k keeps the port open after the first connection and waits for more.

---

1. Check whether a port is open

This is the most common use of nc. For example, you can check whether a website, a mail server or a VPN port is reachable.

# Check port 443 on server 1.1.1.1
nc -zv -w 3 1.1.1.1 443

There are three kinds of answer, and each tells you something different.

Connection to 1.1.1.1 443 port [tcp/https] succeeded!
nc: connect to 127.0.0.1 port 8081 (tcp) failed: Connection refused
nc: connect to 1.1.1.1 port 81 (tcp) timed out: Operation now in progress

• succeeded means the port is open and something answers on it.
• Connection refused means the server is reachable, but nothing runs on this port.
• timed out means there is no reply at all. Most often the port is closed by a firewall, or packets are dropped somewhere along the way.

You can check several ports in a row by giving a range, for example nc -zv -w 2 1.1.1.1 79-81.

---

2. UDP checks and why you cannot trust them

With the -u option nc checks UDP ports, but the result is easy to misread.

nc -zvu -w 2 1.1.1.1 9999

Connection to 1.1.1.1 9999 port [udp/*] succeeded!

Nothing runs on this port of 1.1.1.1, yet nc still says succeeded. The reason is that UDP does not establish a connection, and nc considers the check successful if nobody answered with a refusal. So for UDP services such as WireGuard or AmneziaWG this check proves little. It is more reliable to look at the service itself, for example with ss -lnup on the server.

---

3. Send a message between servers

On the first server, start listening for connections on any free port.

# Wait for a connection on port 12345
nc -l 12345

On the second server, connect to the first one and send a line.

# Send a message and close the connection
echo "hello from another server" | nc -N FIRST_SERVER_IP 12345

The message appears in the first server's window. If you run just nc IP 12345 instead of echo, you get a simple chat, whatever you type on one server shows up on the other. Remember to open the port in the first server's firewall if it is enabled.

---

4. Transfer a file

The same technique works for files. On the receiving server, start receiving.

# Receive data on port 12346 and write it to a file
nc -l 12346 > backup.tar.gz

On the sending server, send the file.

# Send the file and close the connection when done
nc -N RECEIVING_SERVER_IP 12346 < backup.tar.gz

After the transfer, compare the checksums on both servers with sha256sum backup.tar.gz, they must match. On the test server a 2 MB file arrived without a single error, and the checksums matched.

nc does not encrypt data

Everything sent through nc travels over the network in plain text. For files with passwords, keys and databases, use scp or rsync over SSH.

---

5. Start a temporary web server

Sometimes you need to check whether traffic reaches the server on a given port before the application itself is installed. nc can answer one browser request.

# Answer one HTTP request on port 8080
printf 'HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\nHello from nc\n' | nc -l -N 8080

Open http://SERVER_IP:8080 in a browser and you will see the line Hello from nc. In the server terminal nc shows the browser's request itself, with the GET / HTTP/1.1, Host and User-Agent headers. If the page does not open, the port is closed by the server firewall or along the way.

---

6. Look at a server's reply

nc lets you send a request by hand and see what a service answers. For example, this is how you can see a website's headers.

# Request a website's headers over HTTP
printf 'HEAD / HTTP/1.0\r\nHost: example.com\r\n\r\n' | nc -w 5 example.com 80

HTTP/1.1 200 OK
Date: Tue, 20 Oct 2026 19:44:21 GMT
Content-Type: text/html; charset=utf-8

The same way you can see the greeting of a mail server on port 25 or an SSH server on port 22.

---

Frequently asked questions

The nc command is not found

Install it. On Debian and Ubuntu it is apt install -y netcat-openbsd, on AlmaLinux and Rocky Linux it is dnf install -y nmap-ncat.

An option from a guide on the internet does not work

Most likely the guide was written for another version of nc. For example, the old netcat-traditional sets the listening port with -l -p 12345, while netcat-openbsd uses just -l 12345. The nc -h command lists the options of your version.

A file transfer never finishes

The sending side is missing the -N option. Without it nc does not close the connection after sending the file. Stop the transfer with Ctrl + C, repeat it with -N, and then compare the checksums.

nc says the port is open, but the application does not connect

nc only checks that the port accepts connections. If the application still does not connect, the problem is in its settings or protocol. Look at the application log and run a traceroute to the server if you suspect the network.

---

Our resources

Telegram channel: https://t.me/f3cloud_news
F3 Cloud: https://f3cloud.com