The nc or netcat command is a network tool that allows users to transfer files between devices, scan ports and diagnose problems. This tutorial explains 10 nc usages to scan ports, transfer files, and banner grabbing.

Installing netcat in Linux

 To begin, on Debian-based Linux distributions, run the command below to install Netcat.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-01.png" data-lazy- height="424" src="data:image/svg xml,” width=”939″>

On Red Hat-based Linux distributions, you can install Netcat by running the command below.

Scanning a port using nc

Netcat or nc can be used to scan ports. The syntax to scan a single port is the following.

nc -zvn

As you can see, the syntax calls Netcat with the chosen options (explained below) followed by the target IP address and the target port, as shown in the following practical example.

nc -zvn 172.67.209.252 80

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-02.png" data-lazy- height="229" src="data:image/svg xml,” width=”939″>

Where:

  • -z: This option is used to scan without establishing a connection.
  • -v: The verbosity option prints the scan result.
  • -n: This option is used to skip the DNS lookup and warnings.

Scanning multiple ports with nc

 You also can use Netcat/nc to scan multiple ports. The syntax is the same as shown previously; just add a space and the ports you want to scan, as shown in the example below in which ports 80, 22, and 53 are scanned.

nc -zvn 172.67.209.252 80 22 53

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-03.png" data-lazy- height="220" src="data:image/svg xml,” width=”939″>

Scanning port ranges with Netcat

 You can scan port ranges by implementing a hyphen, as shown in the following example in which all ports from 80 to 89 (included) are scanned.

nc -zvn 172.67.209.252 80-89

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-04.png" data-lazy- height="466" src="data:image/svg xml,” width=”939″>

Banner grabbing with Netcat

 Banner grabbing is a technique used to learn the software version running on a target. System administrators use it to keep an inventory of on-device software. Hackers also use it as part of the footprinting process.

Banner grabbing analyzes the network responses to try to guess or learn the software behind our target. The following example shows how using nc or netcat without options (or using the -v option) leads to information on the target FTP server version.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-05.png" data-lazy- height="356" src="data:image/svg xml,” width=”939″>

As you can see, Netcat detected Pure-FTPd on the target. The output also lets us know anonymous login is forbidden, and the server supports IPv6.

Transferring files using nc (Current directory)

 Netcat (nc) is also useful to transfer files between devices. In the following example, a file named linuxhint.txt will be transferred from a device to another.

The device the file will be sent to on the receiving device, run the command below, where the -l option tells Netcat to stay in listening mode waiting for inbound connections. The -p option defines the port number, and > [FileName] specifies the file to be received. Run the command below on the receiving device, replacing linuxhint.txt with the name of the file you want to transfer.

nc -l -p 9899 > linuxhint.txt

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-06.png" data-lazy- height="266" src="data:image/svg xml,” width=”824″>

The computer from which the file is being sent on the sending device, run the command below where the -w option specifies the timeout (2 seconds in this case). On the sending device, the port doesn’t require the -p option. The < [FileName] specifies the file to be sent.

nc -w 2 192.168.1.102 9899 < linuxhint.txt

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-07.png" data-lazy- height="129" src="data:image/svg xml,” width=”939″>

As you can see on the destination device, the file was transferred correctly.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-08.png" data-lazy- height="195" src="data:image/svg xml,” width=”775″>

Sending files stored in a different directory using nc

 The previous example shows how to send a file that is stored in the current directory. If the sender wants to send a file that isn’t stored in the current directory, he can specify a path to send.

On the receiving device, run the same command of the previous example without changes, as shown below.

nc -l 9899 > linuxhint.txt

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-09.png" data-lazy- height="270" src="data:image/svg xml,” width=”787″>

The only change we will apply on the sending device is the inclusion of the directory where the file is stored. For this example, I moved the linuxhint.txt to the linuxhintdir directory. As you can see, the whole path to the file is specified as < linuxhintdir/linuxhint.txt, where linuxhintdir is a subdirectory of the current directory.

nc -w 2 192.168.1.102 9899 < linuxhintdir/linuxhint.txt

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-10.png" data-lazy- height="145" src="data:image/svg xml,” width=”939″>

The file you want to send is inside your home directory, and your current directory is different; the command executed on the sender device would be the following.

nc -w 2 192.168.1.102 9899 < /home/linuxhint/linuxhint2.txt

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-11.png" data-lazy- height="108" src="data:image/svg xml,” width=”939″>

Receiving files and storing them in a different directory using nc

 Contrary to the previous scenario, the receiver may not want to store the transferred file in the current directory. When enabling the listening mode for inbound connections on the receiving computer, you can define the directory to store files. The syntax is the same as when sending files from a subdirectory; just specify the subdirectory and file name as shown below.

nc -l -p 8999 > subdirectory/linuxhint.txt

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-12.png" data-lazy- height="124" src="data:image/svg xml,” width=”939″>

On the second computer, use the same commands explained previously; in this example, the file to send is stored in the home, not in the current directory.

nc -w 2 192.168.1.102 9899 < /home/linuxhint/linuxhint2.txt

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-13.png" data-lazy- height="118" src="data:image/svg xml,” width=”939″>

And as you can see, the file is stored in the defined directory. Also, the file name changed from linuxhint2.txt to linuxhint.txt as defined in the receiving computer command.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-14.png" data-lazy- height="170" src="data:image/svg xml,” width=”939″>

Showing file transfer progress when using nc

The pv command implementation displays the transference progress through the pipe. With this command, we can add progress information when using Netcat.

To install pv in Debian-based Linux distributions, run the command below.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-15.png" data-lazy- height="314" src="data:image/svg xml,” width=”939″>

Add a pipe after the port on the receiving device, followed by the pv command, the path and file name you want to save, as shown in the example below.

netcat -l 9899 | pv > linuxhint2.txt

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-16.png" data-lazy- height="143" src="data:image/svg xml,” width=”920″>

Send the file from the sender device:

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-17.png" data-lazy- height="120" src="data:image/svg xml,” width=”939″>

You’ll see the progress in the receiving device where you added the pv command.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-18.png" data-lazy- height="143" src="data:image/svg xml,” width=”920″>

Compressing and transferring files on the fly with nc

 You also can compress files when sending through Netcat with a single execution using pipe. The following example shows how to compress the linuxhint2 directory and send it through netcat.

Leave nc listening for inbound connections; you can implement the pv command to see progress.

nc -l -p 9899 | pv > linuxhint2

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-19.png" data-lazy- height="245" src="data:image/svg xml,” width=”841″>

On the sender, compress the directory or file using the tar command with the proper options and shown below. Then add pipe and send as normal without specifying the file, already specified when compressing.

tar cfvz – linuxhint2 | nc -w 2 192.168.1.102 9899

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-20.png" data-lazy- height="150" src="data:image/svg xml,” width=”939″>

As you can see, the file was transferred and extracted properly.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-21.png" data-lazy- height="302" src="data:image/svg xml,” width=”895″>

Transferring a whole disk or partition using nc

 This tutorial’s last example shows how to transfer a whole partition or disk using Netcat.

On the receiving device, run the command below.

nc -p 9899 -l | bzip2 -d | dd of=/dev/sda1

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-22.png" data-lazy- height="189" src="data:image/svg xml,” width=”939″>

On the sender, type the following command, replace /dev/sda1 for the disk or partition you want to transfer.

bzip2 -c /dev/sda1 | nc 192.168.1.102 9899

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/nc-command-examples-23.png" data-lazy- height="156" src="data:image/svg xml,” width=”939″>

Conclusion

Netcat is a very basic tool any Linux user or user dealing with networking must know. Using it is pretty simple, as shown in this tutorial. Netcat is designed to be used by other programs or scripts; it is a good aid for developers.

I hope this Netcat tutorial explaining 10 different usages was useful to you. Keep following Linux Hint for more Linux tips and tutorials.

About the author

<img alt="" data-del="avatar" data-lazy-src="https://kirelos.com/wp-content/uploads/2021/08/echo/linuxinstitute_icono-150×150.png61213d450f367.jpg" height="112" src="data:image/svg xml,” width=”112″>

David Adams

David Adams is a System Admin and writer that is focused on open source technologies, security software, and computer systems.