Testing Network Connections with nc: Practical Checks and Limits

nc (netcat) is useful when you need to answer a narrow networking question: can this machine connect to that host and TCP port? It can also open a temporary listener or send raw data. But a successful connection test does not prove an application is healthy, and the exact options depend on which netcat implementation you have.

Check a TCP connection

For OpenBSD netcat and Ncat, a common zero-I/O check is:

nc -zv -w 3 example.com 443

Here, -z attempts a connection without sending application data, -v requests a more informative result, and -w 3 sets a three-second timeout. Confirm these options in your local nc help or manual before relying on them; traditional netcat variants may behave differently.

Interpret the result narrowly:

• Connection succeeds: a TCP connection was established at that moment. This does not confirm that the service is responding correctly at the application level.
• Connection refused: the attempt was actively rejected. Check that the destination and port are correct and that a service is listening.
• Timeout: no connection was established before the wait expired. That alone does not identify the cause.

For local socket inspection, nc is not the right tool. The Linux ss command guide covers how to inspect listening sockets on the machine itself.

Connect interactively

You can connect to a TCP service directly:

nc example.com 443

Netcat attaches to the connection and sends whatever you type. Press Ctrl+C to close it.

A TCP connection to port 443 is not the same thing as an HTTPS request. Port 443 commonly expects TLS, and plain nc does not negotiate TLS or construct an HTTP request for you. Use a protocol-aware client such as curl when you need to test an HTTP or HTTPS response.

Make a temporary listener

Netcat can wait for an incoming connection. With OpenBSD netcat and Ncat, a basic listener looks like this:

nc -l 12345

In a second terminal on the same machine, connect to it:

nc 127.0.0.1 12345

Text typed at either end should appear at the other. For a test between machines, connect to the listener machine's reachable address instead of 127.0.0.1.

Listener syntax varies: some traditional versions use a form such as nc -l -p 12345. Check nc -h or man nc rather than assuming flags from one implementation work in another. Stop the listener with Ctrl+C when the test is done. While it runs, it accepts connections on that port, so keep temporary listeners limited to systems and networks you control or have permission to test.

UDP needs different expectations

Add -u to send UDP rather than TCP. For example:

printf 'status\n' | nc -u -w 2 example.com 12345

Replace the host, port, and message with values appropriate to the service. Unlike TCP, UDP has no connection handshake. Many services also ignore arbitrary messages, so no response does not prove that the port is closed, and a tool reporting that a UDP attempt succeeded does not prove that an application is listening.

For a useful UDP test, send a valid request for the protocol and know what response to expect. Check your installed manual for the supported flags and timeout behavior.

Use netcat for raw data carefully

Netcat can stream a file between two machines, but this simple approach does not provide encryption, authentication, or an integrity check. Use it only on a trusted network for data that is appropriate to send this way.

On the receiving machine, start a listener and redirect its input to a new file:

nc -l 12345 > received.bin

Then, on the sending machine:

nc receiver.example 12345 < file.bin

Start the receiver first. Netcat variants differ in how they handle end-of-file and connection shutdown, so verify that the transfer completed instead of assuming a returned prompt is enough. Compare file sizes and, ideally, SHA-256 hashes:

sha256sum file.bin
sha256sum received.bin

Be careful with >: the shell can truncate an existing destination file as soon as the command starts. For sensitive transfers, use an authenticated encrypted option such as SFTP; the OpenSSH SFTP command reference covers common file-transfer operations.

When nc is missing or behaves unexpectedly

Minimal Linux installations may not include netcat. On Debian or Ubuntu, one package providing OpenBSD netcat is netcat-openbsd:

sudo apt install netcat-openbsd

On Fedora or RHEL-family systems, nmap-ncat provides Ncat, often invoked as nc:

sudo dnf install nmap-ncat

Package names and availability can vary by release and repository. If the command is missing, check your distribution's package search. After installation, inspect the implementation before using less-common options:

nc -h
man nc

A quick way to choose the right tool:

• Use nc for a basic connection test, a temporary listener, or raw data.
• Use curl for HTTP and HTTPS requests.
• Use Nmap for structured network discovery or authorized port scanning.

Keep tests scoped to systems you own or are authorized to assess, and stop temporary listeners when you're finished.

I originally published a more detailed version of this guide on the SSHFlow blog.

I'm also building SSHFlow — an SSH client where every server gets its own workspace for terminals, SFTP, code, and databases.