iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Netcat (usually run as nc) lets you test network reachability from a Linux shell without installing a full client for the service. For a bounded TCP check, run nc -v -z -w 5 SERVER_IP PORT. For UDP, start a listener with nc -u -l 5000 and send a datagram with printf 'hello over udpn' | nc -u -v -w 5 SERVER_IP 5000. A successful TCP connection proves that a socket was accepted; a UDP sender returning to the prompt proves almost nothing unless the listener, application, or a packet capture confirms delivery.
What netcat tests—and what it cannot prove
Netcat is a command-line utility for opening TCP or UDP connections, writing and reading bytes, and listening on a local port. It can also work with Unix-domain sockets and IPv4 or IPv6. Ubuntu’s OpenBSD nc manual describes it as a general-purpose utility for TCP, UDP, and Unix-domain sockets. Ncat, the related implementation from the Nmap Project, likewise provides command-line connect and listen modes, with TCP as its default and UDP selected with -u.
The distinction between a socket test and an application test is important:
- A successful TCP handshake means that the destination address was reachable and a process accepted a socket on that port at that moment.
- It does not verify an HTTP response, a database login, an SMTP exchange, a TLS certificate, authentication, or any other application behavior.
- UDP has no TCP-style handshake. A command can finish even when a firewall dropped the datagram or no process was listening.
- Netcat sends and receives unstructured bytes. Use the target protocol’s own client when you need a meaningful health check.
Only test systems and ports you own or are explicitly authorized to assess. Do not put passwords, API keys, personal data, or other sensitive material into an unencrypted netcat session.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Identify which netcat you have
There is no single netcat implementation on every Linux distribution. A host may provide OpenBSD nc, Ncat, BusyBox nc, or another variant. Listener syntax, timeout behavior, IPv4/IPv6 switches, UDP details, and scan options can differ. Check the local program before copying a command from another system.
- Run
nc -hand read the usage text. Some builds print help to standard error; that is normal. - Try
nc -Vwhere the implementation supports a version switch. - Read
man nc(or the local Ncat manual) and confirm the meanings of-l,-u,-v,-w, and-z. - Check whether the command is BusyBox-backed with
nc --helpor the output ofbusybox | grep ncif BusyBox is installed.
The examples in this guide use the OpenBSD-style syntax documented by Ubuntu. Ncat equivalents are shown where the behavior is materially different. If your local help disagrees with an example, follow the local manual rather than forcing the example.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minutePrepare a reliable test
Choose the source and destination deliberately
Run the client command from the same network location as the failing application whenever possible. A test from an administrator’s laptop can succeed while a test from a private application subnet fails because routing, firewall policy, or DNS resolution differs. Record the exact destination address, port, protocol, and test time.
Use an address you can verify
If a hostname is involved, resolve it first and test the resulting address as well as the name. An unexpected IPv6 answer, a stale DNS record, or a service bound only to one interface can make an otherwise correct command appear broken. OpenBSD-style builds commonly provide -4 and -6 switches; confirm their availability with nc -h before using them.
Set a timeout
Without a bound, a filtered connection can wait far longer than is useful for an operational check. The examples use -w 5 for a five-second connection/idle limit, or -w 2 for a short port-range probe. Timeout units and their exact scope are implementation-specific, so verify them locally.
Test whether a TCP port is open
Make a verbose connection attempt
Use this when you want to establish a TCP connection and, if needed, type or pipe data after it connects:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
nc -v -w 5 SERVER_IP PORTReplace SERVER_IP with an address or resolvable host name and PORT with a decimal port number. The -v flag prints connection status, while -w 5 bounds the wait. A successful message indicates that the TCP three-way handshake completed and the remote side accepted the socket. Exit with Ctrl-C if the service keeps the connection open.
Perform a zero-I/O check
For a port-state check that sends no application payload, add -z:
nc -v -z -w 5 SERVER_IP PORTZero-I/O mode asks whether a listening daemon will accept a connection and then closes it. It is useful for deployment checks and firewall diagnostics because it does not send a protocol message. It cannot tell you whether the service will return a valid response, require authentication, negotiate TLS, or reject the next request based on application rules.
Read the result correctly
- Connected or succeeded: the address and TCP port accepted a socket during this attempt.
- Connection refused: the host was reachable, but the destination kernel reported that no process accepted that TCP port, or an active device rejected it.
- Timed out: no usable response arrived before the timeout. Filtering, routing, a stopped service, an incorrect address, or an interface binding problem are all possible.
- Name or option error: the command did not perform a network test. Recheck the host name, port, syntax, and implementation.
For a protocol-level check, use the service’s client after the socket test. For example, an HTTP request should be tested with an HTTP-aware tool, not inferred from a successful nc -z result.
Recommended Free Tools
Build a TCP listener and test both ends
Start a one-shot listener
On the server or a test host, listen on TCP port 5000:
nc -l 5000The listener normally binds to a local address and waits for one incoming connection. Keep this terminal visible so you can see data that arrives. Binding behavior differs among implementations; if remote clients cannot connect, inspect the help output for an explicit bind-address option and bind to the intended interface rather than only to loopback.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Connect from another host and send a line
From a second machine, send a known string:
printf 'hello over tcpn' | nc -v -w 5 SERVER_IP 5000The remote listener should display hello over tcp. This single test exercises DNS or address selection, routing, host and network firewalls, the listening socket, and return traffic. If the sender reports success but the listener shows nothing, confirm that both commands use TCP, that the destination address is the listener’s reachable interface, and that no middlebox redirected the connection.
Keep an Ncat listener open for multiple clients
Ncat supports a persistent listener with -k (also written --keep-open):
ncat -l -k 5000This accepts multiple connections instead of exiting after the first one. Do not assume that nc -l -k has the same behavior on every non-Ncat build; check the local option list first.
Stop and clean up the test
Press Ctrl-C in the listener terminal when the test is complete. A temporary listener is still a network service: leaving it exposed can allow unexpected users to connect and send data. If a system service should own the port, stop the temporary listener before starting that service.
Test UDP connectivity with netcat
Listen for UDP datagrams
On the destination host, start a UDP listener:
nc -u -l 5000The -u flag selects UDP. OpenBSD nc documents that a UDP listening socket can receive datagrams from multiple hosts. Keep the terminal open; it is your delivery confirmation.
Send a datagram
From another host, send a short payload:
printf 'hello over udpn' | nc -u -v -w 5 SERVER_IP 5000When the listener prints the text, you have demonstrated that a datagram reached that socket. The sender’s return to the shell alone is not proof: UDP does not negotiate a connection, and many applications do not answer unsolicited packets.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Confirm delivery when no listener output appears
- Make sure the listener is actually running on the expected address and port.
- Check that host firewalls and cloud security groups allow UDP, not merely TCP, on that port.
- Verify the destination route and address family; test an IPv4 address and an IPv6 address separately when both exist.
- Capture traffic on the sender and receiver with an authorized packet analyzer. Seeing the packet leave but not arrive narrows the fault to routing or filtering; seeing it arrive but not reach the application points to local binding or service behavior.
- If the application intentionally sends no response, treat the listener or packet capture as the required evidence.
Check a range of TCP ports
OpenBSD-style netcat supports a port range with zero-I/O mode:
nc -vz -w 2 SERVER_IP 20-25This checks each port in the range without sending application data. Use it for a narrowly scoped reachability check, such as confirming that a newly opened firewall rule covers the intended ports. It is reconnaissance, not a vulnerability scan, and it does not identify or validate the service protocol behind an open socket. Keep the range and rate within your authorization and change-control limits.
Range syntax is not universal. If your implementation rejects 20-25, consult its help text for supported port-list or range notation rather than assuming another build behaves identically.
Use exit status in scripts and monitoring
When automation needs a binary result, inspect the command’s exit status immediately:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →if nc -z -w 5 SERVER_IP PORT; then
echo "TCP port is accepting connections"
else
echo "TCP check failed"
fiNcat documents status 0 for a successful connection, 1 for a network error such as “Connection refused” or “Connection reset,” and 2 for other errors, including an invalid option or missing file. Other netcat implementations may use different codes, so confirm the local manual before building alert logic around a particular number.
Capture both standard output and standard error in a monitoring system, because verbose diagnostics are often written to standard error. Include the destination, protocol, timeout, and timestamp in the log. A single timeout should trigger investigation rather than an immediate assumption that the service is down; retry policy belongs in the monitoring design, not in an unbounded netcat command.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Diagnose failures methodically
Start with the listening socket
On the destination Linux server, run:
ss -lntupThis lists listening TCP and UDP sockets and the associated processes when permissions allow. Confirm the expected port, protocol, process, and local address. A service listening on 127.0.0.1 or ::1 is reachable only from the local host; a remote client needs the service bound to the intended interface or a deliberate proxy.
Separate refusal from timeout
A refusal generally means the host responded but no process accepted that TCP port. Check that the service is started, that it did not crash after binding, and that you used the right address and port. A timeout offers less information: inspect routing, network ACLs, host firewall policy, cloud security groups, and whether an intermediate device silently drops packets.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check address-family and DNS mismatches
Compare the address returned for the host name with the address on which the service listens. A name may resolve to both IPv4 and IPv6 while the daemon is bound to only one family. Use the implementation’s explicit family switches when available, and repeat the test against each verified address.
Validate UDP from both sides
For UDP, inspect the receiver’s listener, firewall counters, and packet captures. A missing application response can be normal. The strongest evidence is a payload visible at the listener or an application-level response that you can attribute to the test packet.
Compare captures when the path is ambiguous
If client and server logs disagree, capture the same test on both ends under your organization’s policy. A packet present on the client interface but absent on the server indicates a path or filtering problem. A packet present on the server but not delivered to the process suggests local firewall rules, socket binding, or application handling. Stop captures after collecting the minimum data needed and protect any captured payloads.
OpenBSD nc and Ncat: practical differences
Both implementations cover the basic workflow, but they are not interchangeable command-for-command.
| Capability | OpenBSD-style nc |
Ncat | What to verify locally |
|---|---|---|---|
| Default protocol | TCP | TCP | Confirm that -u selects UDP. |
| Connect mode | Positional host and port, for example nc HOST 5000 |
Positional host and port, for example ncat HOST 5000 |
Check accepted address and port formats. |
| Listen mode | -l, commonly followed by a port |
-l, commonly followed by a port |
Binding and repeat-connection syntax can differ. |
| UDP | -u |
-u |
Verify listener behavior and whether replies are expected. |
| Timeout | -w is commonly available |
-w is available |
Confirm whether the value covers connect, idle, or both. |
| Zero-I/O check | -z |
-z |
Ensure the build supports it in the mode you plan to automate. |
| Verbose diagnostics | -v |
-v |
Capture standard error as well as standard output. |
| IPv4/IPv6 selection | Often exposed with family switches | Exposed with Ncat options | Read nc -h or ncat --help. |
| Persistent listener | Varies by build | -k or --keep-open |
Do not assume -k exists or means the same thing elsewhere. |
| Additional modes | Core socket and data-transfer functions | TLS, proxying, brokering, and explicit connection limits are available | Use the Ncat manual for security and certificate requirements. |
| Exit-status documentation | Varies by implementation | 0 success, 1 network error, 2 other error |
Test the installed binary before hard-coding status handling. |
Choose the implementation already supported by your distribution and operational tooling. If you need TLS, proxying, brokering, or a persistent listener, Ncat exposes those modes; for a basic TCP or UDP reachability check, either implementation is sufficient when its local syntax is confirmed.
Apply the right test to the question
| Question | Recommended test | Evidence you need |
|---|---|---|
| Is a TCP daemon accepting sockets? | nc -v -z -w 5 HOST PORT |
A successful connection message and exit status. |
| Can two hosts exchange TCP bytes? | Listener with nc -l PORT, then pipe text from a second host |
The expected text appears at the listener. |
| Can a UDP datagram reach a host? | UDP listener plus printf ... | nc -u ... |
The listener prints the payload, or a packet capture shows arrival. |
| Does an HTTP, database, or mail service work? | First test the socket; then use the protocol’s client | A valid application response and, where applicable, successful authentication. |
| Which ports in a small approved range accept TCP? | nc -vz -w 2 HOST START-END |
Per-port results, interpreted as reachability only. |
Security and operational cautions
- Run tests only against assets and ports covered by your authorization. A range probe can violate policy even when each individual connection is harmless.
- Plain netcat has no encryption. Assume anything sent through a basic session can be read or modified by an intermediary.
- Ncat offers TLS options, but a TLS check must use the target’s required protocol versions, certificate validation, server name, and client-authentication settings. A generic TLS-enabled connection is not automatically equivalent to the production client.
- Temporary listeners expose a port and may accept input from any reachable host. Bind narrowly, restrict firewall access, and stop the process after testing.
- Do not interpret a successful zero-I/O probe as evidence that authentication, authorization, encryption, rate limits, or application semantics are correct.
A compact repeatable workflow
- Identify the installed implementation with
nc -h,nc -Vwhere supported, and its manual. - Write down the source host, destination address, protocol, port, and test time.
- For TCP reachability, run
nc -v -z -w 5 HOST PORT. - If you need end-to-end byte transfer, start a matching TCP listener and pipe a harmless marker string.
- For UDP, start a UDP listener first, send a marker datagram, and require listener output or packet-capture evidence.
- When a test fails, inspect
ss -lntup, service binding, firewall and security-group policy, routing, DNS, and address family in that order. - Use an application-aware client for the final health decision, and remove any temporary listeners.
This workflow keeps netcat in its proper role: a fast socket and byte-path diagnostic, not a substitute for a protocol-specific health check or a security scanner.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
