Linux and Unix Port Scanning With netcat [nc] Command

How do I find out which ports are opened on my own server? How do I run port scanning using the nc command instead of the nmap command on a Linux or Unix-like systems?

The nmap (“Network Mapper”) is an open source tool for network exploration and security auditing. If nmap is not installed and you do not wish to use all of nmap options you can use netcat/nc command for scanning ports. This may useful to know which ports are open and running services on a target machine. You can use nmap command for port scanning too.[donotprint]
Tutorial details
DifficultyEasy (rss)
Root privilegesNo


How do I use nc to scan Linux, UNIX and Windows server port scanning?

If nmap is not installed try nc / netcat command as follow. The -z flag can be used to tell nc to report open ports, rather than initiate a connection. Run nc command with -z flag. You need to specify host name / ip along with the port range to limit and speedup operation:

## syntax ##
nc -z -v {host-name-here} {port-range-here}
nc -z -v host-name-here ssh
nc -z -v host-name-here 22
nc -w 1 -z -v server-name-here port-Number-her
## scan 1 to 1023 ports ##
nc -zv 1-1023

Sample outputs:

Connection to localhost 25 port [tcp/smtp] succeeded!
Connection to 25 port [tcp/smtp] succeeded!
Connection to 80 port [tcp/http] succeeded!
Connection to 143 port [tcp/imap] succeeded!
Connection to 199 port [tcp/smux] succeeded!
Connection to 783 port [tcp/*] succeeded!
Connection to 904 port [tcp/vmware-authd] succeeded!
Connection to 993 port [tcp/imaps] succeeded!

You can scan individual port too:

nc -zv v.txvip1 443
nc -zv v.txvip1 80
nc -zv v.txvip1 22
nc -zv v.txvip1 21
nc -zv v.txvip1 smtp
nc -zvn v.txvip1 ftp
## really fast scanner with 1 timeout value ##
netcat -v -z -n -w 1 v.txvip1 1-1023

Sample outputs:

Fig.01: Linux/Unix: Use Netcat to Establish and Test TCP and UDP Connections on a Server

Fig.01: Linux/Unix: Use Netcat to Establish and Test TCP and UDP Connections on a Server


  1. -z : Port scanning mode i.e. zero I/O mode.
  2. -v : Be verbose [use twice -vv to be more verbose].
  3. -n : Use numeric-only IP addresses i.e. do not use DNS to resolve ip addresses.
  4. -w 1 : Set time out value to 1.

More examples:

$ netcat -z -vv http [] 80 (http) open
 sent 0, rcvd 0
$ netcat -z -vv https
DNS fwd/rev mismatch: !=
DNS fwd/rev mismatch: !=
DNS fwd/rev mismatch: !=
DNS fwd/rev mismatch: !=
DNS fwd/rev mismatch: !=
DNS fwd/rev mismatch: !=
DNS fwd/rev mismatch: !=
DNS fwd/rev mismatch: != [] 443 (https) open
 sent 0, rcvd 0
$ netcat -v -z -n -w 1 1-1023
(UNKNOWN) [] 989 (ftps-data) open
(UNKNOWN) [] 443 (https) open
(UNKNOWN) [] 53 (domain) open
See also
🐧 Get the latest tutorials on SysAdmin, Linux/Unix, Open Source/DevOps topics:
CategoryList of Unix and Linux commands
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNCentOS 8 Debian 10 Firewall Ubuntu 20.04

9 comments… add one
  • Paul Aug 20, 2012 @ 13:32

    I had to add verbosity (-v) to get the output as above. By default my version displayed nothing. (Talking of that, I couldn’t figure out how to get it’s version…)

  • Sandeep Mar 20, 2013 @ 14:55


    I run this command on my ubuntu server but I am not getting that kind of output as you provided here. When I am using -z option that time it is not giving any kind of output. If use -t or option then it is giving output for port range 1-100 .. output is :SSH-2.0-OpenSSH_5.1p1 Debian-5ubuntu1 only.

    I.e it is scanning for port 22 only.

    Could you please tell me why options are not running on Ubuntu ?

  • Allen Mar 21, 2013 @ 21:57

    I had to add -v for it to work for me

    nc -z -v 22
    Connection to 22 port [tcp/ssh] succeeded!

  • Tom Oct 31, 2013 @ 16:58

    nc -zv server port
    for lazy ones .)

  • Bom Feb 19, 2015 @ 10:39

    Do more faster port-scan using gnu-parallel.

    time seq 65535 | parallel --pipe --cat -j200% -n1000 'nc -vz localhost $(head -n1 {})-$(tail -n1 {})'
    real    0m52.813s
    user    3m16.853s
    sys     0m7.860s


    time nc -vz localhost 1-65535
    real    1m49.139s
    user    1m44.407s
    sys     0m4.733s
  • schland Dec 10, 2015 @ 19:38

    most of my classmates use netcat to cheat in the exam : P

  • Kevin Liang May 30, 2016 @ 23:24

    Hi, this is a great guide.
    However, when using netcat to conduct a port scan, the results can be lengthy. Is there any way to have netcat -zv [host] [port ranges] display only OPEN PORTS?

    • Zakaria Dec 28, 2016 @ 1:04

      did you figured out how to show only opened ports ?

      • ad Jan 12, 2017 @ 8:18

        Use grep.

        netcat -zv [host] [port ranges] 2>&1 | grep succeeded

        netcat -zv [host] [port ranges] |& grep succeeded

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre>, <code>...</code> and <kbd>...</kbd> for code samples.