When you are troubleshooting a network issue in Linux—perhaps a web server is refusing connections, or a firewall seems to be blocking traffic—you need a tool that can interact directly with TCP and UDP ports without relying on complex, top-level applications like a web browser.
The netcat utility (commonly invoked as nc) is widely referred to by system administrators as the “Swiss Army knife of TCP/IP”. It is a lightweight, incredibly powerful command-line tool that can read and write data across network connections.
In this guide, you will learn how to use the nc command to diagnose network connectivity, test open ports, and even send raw data between servers.
Use Case 1: Testing Port Connectivity
The most common use of netcat is to check if a specific port on a remote server is open and accepting traffic. While the ping command can tell you if the server itself is online, it cannot tell you if the web server software (running on port 80 or 443) is actually functioning.
To test if port 80 is open on a server with the IP address 192.168.1.50, use the following syntax:
nc -zv 192.168.1.50 80- -z: Tells netcat to operate in “Zero-I/O mode”. It will only attempt to open the connection to see if it succeeds, and will immediately close it without sending any actual data.
- -v: Enables verbose output, forcing netcat to print the result to the screen.
If the port is open and the firewall allows the connection, you will see a success message: Connection to 192.168.1.50 80 port [tcp/http] succeeded!
Use Case 2: Port Scanning a Range
If you are unsure which ports are open on a specific machine, you can ask netcat to scan an entire range of ports sequentially.
nc -zv 192.168.1.50 20-80Netcat will test every single port from 20 to 80. It will output a success message for any open ports and a “Connection refused” message for the closed ones. Note: While useful for quick diagnostics, for heavy-duty security auditing, tools like Nmap are preferred.
Use Case 3: Creating a Listening Server
Netcat can also act as a rudimentary server. If you are configuring a new firewall and want to verify that it allows incoming traffic on port 8080, you can temporarily instruct netcat to listen on that port.
On the server you are testing (Server A), run:
nc -l -p 8080- -l: Listen mode.
- -p: Specifies the port to listen on.
The terminal will appear to hang, as netcat is now silently waiting for a connection.
On a different computer (Server B), use netcat to connect to Server A:
nc 192.168.1.50 8080Once the connection is established, anything you type on Server B and press Return will instantly appear on the screen of Server A. You have just created a direct, unencrypted chat room over a raw TCP socket. If the text appears, you have definitively proven that the firewall is allowing traffic on port 8080.
Security Warning
Because netcat is so powerful (it can even be used to create reverse shells), many modern Linux distributions do not install it by default, and some corporate endpoint detection systems flag its usage as suspicious. Always ensure you have authorization before running port scans on a network.