NC

Top 10 Netcat Commands for Advanced Networking

Network Tools Guide • 20 Feb 2026

A practical reference for advanced Netcat (nc) usage: commands, parameters, examples, and when to use them for troubleshooting, testing, and automation.

Why Netcat

Netcat is a lightweight, scriptable networking utility for TCP/UDP I/O. It can open raw connections, listen for traffic, transfer files, and pipe data to programs. Implementations vary (traditional netcat, OpenBSD netcat, Ncat), so check nc --help or your man page for local flags.

Top 10 Commands

1

Simple TCP Connect

Open a TCP connection to a host and port for connectivity checks and banner grabbing.

nc example.com 80

host — target hostname or IP port — target port

Test reachability and manually send protocol text (HTTP, SMTP) to inspect server banners.

2

Listen Mode (Server)

Start a TCP listener to accept incoming connections—useful for quick servers, file receives, or reverse shells.

nc -l -p 4444

-l — listen mode -p PORT — local port to bind

Accept a client connection for testing or file transfer. Use only on trusted networks.

3

UDP Mode

Use UDP instead of TCP to test UDP services and protocols.

nc -u -l -p 53

-u — use UDP -l — listen

Test DNS servers, syslog over UDP, or custom UDP-based services.

4

Zero I/O Mode (Port Scanning)

Scan a range of ports by checking which ports accept connections without sending data.

nc -z -v example.com 20-1024

-z — zero I/O (scan only) -v — verbose

Quick port discovery during troubleshooting; not a full replacement for nmap but handy for scripts.

5

Bind to Specific Local Interface

Choose the source IP/interface for outgoing connections—useful on multi‑homed hosts or when testing routing.

nc -s 192.168.1.10 example.com 80

-s ADDR — source IP to bind

Validate path selection, test firewall rules per interface, or simulate traffic from a specific NIC.

6

Execute Program on Connect

Run a local program (e.g., a shell) when a connection is established. Many builds omit this flag for safety.

nc -l -p 4444 -e /bin/bash

-e PROG — execute program after connect

Create a quick remote shell for controlled testing. Prefer SSH for secure production access.

7

Keep Listening After Disconnect

Allow the listener to accept multiple sequential connections without restarting.

nc -k -l -p 8080

-k — keep listening -l — listen

Useful for simple persistent services or repeated client testing sessions.

8

Timeouts and Connection Control

Set connection and I/O timeouts to avoid hanging operations in scripts or tests.

nc -w 5 example.com 22
nc -q 2 -l -p 1234

-w SECS — timeout for connects and final reads -q SECS — quit after SECS once stdin EOF

Use in automation to ensure tests fail fast or to close listeners after a grace period.

9

Transfer Files Between Hosts

Send or receive files over a raw TCP connection using shell redirection—simple and scriptable for trusted networks.

# Sender
nc -l -p 9000 < file.tar.gz

# Receiver
nc host.example.com 9000 > file.tar.gz

redirection — use shell redirection to send/receive files

Quick file transfer in maintenance windows or isolated networks. Use checksums and encryption for integrity and confidentiality.

10

IPv4 / IPv6 Selection and Numeric Addresses

Force IPv4/IPv6 or skip DNS lookups to avoid dual‑stack ambiguity or DNS issues.

nc -4 192.0.2.10 80
nc -6 [2001:db8::1] 80
nc -n example.com 80

-4 — force IPv4 -6 — force IPv6 -n — numeric-only, skip DNS

Resolve routing or DNS issues by forcing address family or bypassing DNS lookups for predictable behavior.

Quick Reference

Flag	Meaning
-l	Listen mode (server)
-p PORT	Local port to bind
-u	Use UDP
-z	Zero I/O (scan only)
-e PROG	Execute program after connect (not in all builds)
-k	Keep listening after disconnect
-s ADDR	Bind source IP
-w SECS	Timeouts for connect and final reads
-q SECS	Quit after SECS once stdin EOF
-n	Numeric-only, skip DNS
-4 / -6	Force IPv4 or IPv6

Security note: Netcat can create remote shells and transfer files. Use it only on systems and networks you control. Prefer SSH and encrypted tunnels for production remote access. Some netcat variants intentionally omit dangerous flags (for example -e).