How To Create Commandline Chat Server in Linux

We have all used chat services such as Google Chat, Facebook chat, and WhatsApp. Linux's nc (netcat) command can also turn a machine into a very simple command-line chat endpoint with one command. The example below is useful for a quick lab test or a temporary conversation on a trusted LAN. It is not a replacement for a real chat service: there is no account system, encryption, or group-chat feature.

What is the nc command in Linux and what does it do?

nc is the command name used by many implementations of netcat, a networking utility often called a Swiss Army knife. It can read from and write to TCP or UDP connections, making it useful for debugging services, checking ports, transferring data, and temporarily listening on a port. This guide uses TCP, which is the default; do not add -u unless you deliberately want UDP.

The server and client addresses below are examples. Replace 192.168.0.7 and 192.168.0.15 with addresses on your own network.

Start the listener on the server

On the server (192.168.0.7), the traditional GNU netcat syntax is:

nc -l -vv -p 11119

The switches mean:

1. -l: listen for an incoming connection instead of connecting to another host.
2. -v: verbose output; -vv provides more detail.
3. -p 11119: use local TCP port 11119 with this GNU-style listener.

You can replace 11119 with another unused, unprivileged port above 1024. Leave this terminal open.

Netcat is not one identical program on every Linux system. OpenBSD nc, which is common on modern distributions, normally takes the listening port as an argument instead:

nc -l -vv 11119

Ncat, from the Nmap project, is commonly invoked as ncat:

ncat -l -vv 11119

In particular, do not blindly copy GNU's -p listener syntax to OpenBSD nc; its -p option concerns a source port. Run nc -h or read man nc to identify the installed implementation and its supported options.

Connect from the client

On the client (192.168.0.15), connect to the server's address and port:

nc 192.168.0.7 11119

Type a line and press Enter on either terminal; the other terminal should display it. Press Ctrl+C to end the session. This is a direct, one-to-one pipe between two terminals, not a chat room.

Check the listener, route, and firewall

If the client cannot connect, check the server before changing random settings. In another server terminal, run:

ss -ltn | grep ':11119'
sudo ss -ltnp | grep ':11119'

Look for LISTEN. A listener on 127.0.0.1 accepts only local connections; 0.0.0.0 means all IPv4 interfaces, which may be more exposure than you want. The second command can show the owning process, but process details may require sudo. If nothing is listening, the command may have exited or used syntax unsupported by your netcat variant.

From the client, a short TCP probe can distinguish a closed service from a network problem:

nc -vz -w 3 192.168.0.7 11119

-z performs a connection check rather than starting a chat, and -w 3 sets a timeout. Connection refused usually means nothing is listening on that port. A timeout more often points to a firewall, wrong address, disconnected network, or Wi-Fi client isolation.

On an Ubuntu-style host, inspect the firewall with sudo ufw status verbose. If UFW is active and you need a temporary exception, restrict it to your actual LAN prefix—for this example's network:

sudo ufw allow from 192.168.0.0/24 to any port 11119 proto tcp

Do not copy that subnet if yours differs, and do not create a router port-forward for this exercise. Firewalld users can inspect the active zone with sudo firewall-cmd --list-all. Remove a temporary UFW rule when finished:

sudo ufw delete allow from 192.168.0.0/24 to any port 11119 proto tcp

Limitations and LAN safety

Basic netcat accepts one connection and provides no usernames, message history, presence, delivery guarantees, or multi-user relay. Some versions have -k to keep listening after a disconnect, but that does not turn the session into group chat. Text is also plaintext: someone able to observe or intercept the network path could read it, and the client has no built-in proof of the server's identity. Never type passwords or sensitive information into this chat.

LAN-only use reduces exposure but does not make the connection trustworthy. A compromised laptop or an untrusted shared network can still observe traffic. Use a non-root account, a high port, a trusted LAN, and a narrowly scoped firewall rule; stop the listener when done. Avoid -e or similar “execute a program” options entirely for this recipe—they can turn a simple listener into an unintended remote shell.

Common mistakes

• Address already in use: another process owns the port. Inspect it with ss and choose a different port rather than killing an unknown service.
• The first client disconnects and later clients fail: restart the listener, or check whether your variant supports -k; neither approach adds group-chat semantics.
• A connection succeeds but nothing appears: press Enter after typing, confirm that both ends use TCP and the same port, and make sure you did not leave -z in the chat command.
• The listener command rejects -p: identify the variant and use its documented port syntax instead of adding more flags.

Safer modern alternatives

For remote administration, prefer SSH, which provides encryption and account authentication:

ssh user@192.168.0.7

SSH grants shell access, so it is not automatically a chat replacement; give accounts only the access they need. If you specifically need a netcat-like encrypted pipe, Ncat supports TLS with --ssl and certificate-verification options. Configure and verify certificates rather than treating encryption without identity checks as sufficient. For real private or group conversations, use a maintained messaging application with authentication and end-to-end encryption. A VPN such as WireGuard or Tailscale can protect the network path, but it does not add chat identities, history, or group management to nc.