What is Netcat?

Netcat is a command line tool re­spon­si­ble for reading and writing data in the network. To exchange data, Netcat uses the network protocols TCP/IP and UDP. The tool orig­i­nal­ly comes from the world of Unix but is now available for all platforms.

Due to its universal usability, Netcat is often called the “Swiss army knife for TCP/IP”. For instance, it allows you to diagnose faults and problems that jeop­ar­dize the func­tion­al­i­ty and security of a network. Port scans, data streaming or simple data transfers can also be performed by Netcat. What’s more, chat, and web servers can be set up and mail requests started. The stream­lined software – already developed in the mid-1990s – can operate in server and client mode.

To start the program file (nc.exe), you also need to switch to the storage location. If the nc.exe is saved in the “netcat” folder on the Windows desktop, the syntax will look like this:

Netcat syntax is made up of two basic com­po­nents: the constant base command “nc”, followed by various “options”. The base command addresses the program file nc.exe., while the options determine the specific func­tion­al scope of a Netcat version. Depending on the operating system and Netcat version used, the pos­si­bil­i­ties vary.

The following table only covers the main options available in most versions for Linux, macOS, and Windows. Moreover, ad­di­tion­al useful options are listed – in par­tic­u­lar ex­ten­sions based on the wide­spread GNU Netcat version for Linux, Unix, and macOS:

A simple example for the use of the Netcat syntax is for accessing help with the parameter “-h”:

For instance, if you want to define a server or a client in the network for data trans­mis­sion, the following syntax applies:

Client mode (connect to somewhere):

Server mode (listen for inbound):

The fun­da­men­tal structure for running a port scan is as follows:

A fre­quent­ly used feature of Netcat is copying files. Even large quan­ti­ties of data can be sent and in­di­vid­ual par­ti­tions or entire hard drives cloned. In our example, the testfile.txt file is copied from computer A (client) to computer B (server) via port 6790: These steps are required:

1. Determine the IP address of computer B (des­ti­na­tion PC)
2. Create the test file testfile.txt in the Netcat folder of computer A; in this example, the fest file is located in the client’s Netcat folder. The copied file then ends up in the Netcat folder on computer B (other file paths need to be adjusted ac­cord­ing­ly).
3. Enter the Netcat syntax in the command line

Computer B (acts as the receiving server):

Computer A (acts as the sending client):

The success of the transfer is not confirmed in the command prompt. You can see whether the transfer worked by checking in the des­ti­na­tion folder.

In order to detect any errors and security issues, you can run a scan and identify open ports. In the following example, the computer has the IP address 192.168.11.1. After the IP address, in­di­vid­ual ports (e.g. 1), multiple ports (1, 2, 3 etc.) or a whole range (1-1024) can be entered for the scan:

The option “-w” sets the timeout (here: “try to establish a con­nec­tion with the ports for two seconds”). The option “-z” instructs Netcat to only search for listening services and not to send any data.

If the option “-v” is added, you will obtain detailed in­for­ma­tion about the scan:

Netcat confirms the detection of an open port with the message “succeeded!”:

Most familiar services such as email, FTP or SSH run on the scanned ports 1–1024. In this example, Netcat has found the open SMTP port of an email client.

Netcat can also set up a simple TCP or UDP con­nec­tion between two computers and open up a com­mu­ni­ca­tion channel. In the example below, the recipient is first installed on the remote system and set to listening mode. The recipient then acts as “listener” and uses the port 1605 to receive messages. They can be reached at the IP address 192.168.11.1.

A con­nec­tion is then es­tab­lished by the local computer (sending PC) with the message recipient using the following command:

If the con­nec­tion is suc­cess­ful­ly es­tab­lished, messages can be sent in both di­rec­tions.

Netcat can also be used to set up a simple web server. If the es­tab­lished server can’t be reached due to technical problems, for example, you can at least respond to requests with a prepared failure message (in the form of a html file):

Netcat waits for requests sent to port 85 and responds with the file fail­uremes­sage.html. The option “-L” allows you to maintain the Netcat process beyond a single request. The parameter “-w” ter­mi­nates the con­nec­tion after 10 seconds (timeout). The “-v” parameter gives the server operator in­for­ma­tion about the requests and documents the operating system and browser type of the re­quest­ing client computer, for example, by means of status messages.

Un­doubt­ed­ly, Netcat can be used uni­ver­sal­ly in networks and performs many helpful tasks here. So, it’s no wonder that it is extremely popular among system and network ad­min­is­tra­tors – par­tic­u­lar­ly since creating Netcat code becomes rel­a­tive­ly easy after a certain amount of time.

But there is also a downside: Netcat is a hacking tool used for spying on networks, seeking out vul­ner­a­bil­i­ties, cir­cum­vent­ing fire walls, and ex­ploit­ing backdoors for taking over computers. Anti-virus programs sound the alarm, for example, when a Netcat version is found on the computer which enables execution of the option “-e” due to a special com­pi­la­tion.

Using this “-e” in the code, an in­ter­ac­tive interface (backdoor shell) can be started on a remote computer. Anyone who gains un­re­strict­ed access to the cmd.exe on Windows can inflict a sig­nif­i­cant amount of damage. Ad­di­tion­al malware can also be loaded via a backdoor shell. Hackers often use the Netcat parameter “-d” in the code, which allows the command prompt tool to cause trouble on Windows computers – while running invisibly in the back­ground.

To avoid hacked versions, Netcat should only be down­loaded from safe sources on the internet. Security experts also advise careful con­sid­er­a­tion on whether a tool like Netcat is even needed in the in­stal­la­tion scope of systems (par­tic­u­lar­ly frontend systems).

Another security risk: Netcat generally transmits data in clear text without en­cryp­tion. For this reason, the tool should only be used in networks that are very well protected or – even better – cut off from the internet. For data transfers on the internet, the Netcat successor Cryptcat is better suited since it encrypts the data. Moreover, con­nec­tions can be tunneled via SSH when trans­mit­ting security-relevant data.

The ad­van­tages and potential risks clearly show that Netcat is a tool which well-versed users, system ad­min­is­tra­tors, and IT managers should carefully consider. Those who un­der­stand the ad­van­tages can benefit from the ver­sa­til­i­ty and ef­fi­cien­cy of the remote ad­min­is­tra­tion tool. And those who can suitably assess the dangers for the security of their own network, can take pre­ven­tive measures to stop hacking attacks – or at least contain the damage.

However, the tool is now rather outdated – having emerged in hacking circles over 20 years ago. Better tools exist for a range of network ac­tiv­i­ties. Besides Cryptcat, Socat is worth men­tion­ing. It can use the network protocol SCTP in addition to TCP and UDP, works via proxy servers, and supports en­cryp­tion. It also runs on all common platforms like Netcat.

But Netcat continues to enjoy special status as a stream­lined and rapidly de­ploy­able all-rounder with simple command syntax. In com­bi­na­tion with the ad­min­is­tra­tion tool Netsh, for example, many more options can be used for efficient network di­ag­nos­tics and man­age­ment.