Linux and Unix Port Scanning With netcat [nc] Command

last updated in Categories , ,

How do I find out which ports are opened on my own server? How do I run port scanning using the nc command instead of the nmap command on a Linux or Unix-like systems?

The nmap (“Network Mapper”) is an open source tool for network exploration and security auditing. If nmap is not installed and you do not wish to use all of nmap options you can use netcat/nc command for scanning ports. This may useful to know which ports are open and running services on a target machine. You can use nmap command for port scanning too.

How do I use nc to scan Linux, UNIX and Windows server port scanning?

If nmap is not installed try nc / netcat command as follow. The -z flag can be used to tell nc to report open ports, rather than initiate a connection. Run nc command with -z flag. You need to specify host name / ip along with the port range to limit and speedup operation:

## syntax ##
nc -z -v {host-name-here} {port-range-here}
nc -z -v host-name-here ssh
nc -z -v host-name-here 22
nc -w 1 -z -v server-name-here port-Number-her
## scan 1 to 1023 ports ##
nc -zv 1-1023

Sample outputs:

Connection to localhost 25 port [tcp/smtp] succeeded!
Connection to 25 port [tcp/smtp] succeeded!
Connection to 80 port [tcp/http] succeeded!
Connection to 143 port [tcp/imap] succeeded!
Connection to 199 port [tcp/smux] succeeded!
Connection to 783 port [tcp/*] succeeded!
Connection to 904 port [tcp/vmware-authd] succeeded!
Connection to 993 port [tcp/imaps] succeeded!

You can scan individual port too:

nc -zv v.txvip1 443
nc -zv v.txvip1 80
nc -zv v.txvip1 22
nc -zv v.txvip1 21
nc -zv v.txvip1 smtp
nc -zvn v.txvip1 ftp
## really fast scanner with 1 timeout value ##
netcat -v -z -n -w 1 v.txvip1 1-1023

Sample outputs:

Fig.01: Linux/Unix: Use Netcat to Establish and Test TCP and UDP Connections on a Server
Fig.01: Linux/Unix: Use Netcat to Establish and Test TCP and UDP Connections on a Server


  1. -z : Port scanning mode i.e. zero I/O mode.
  2. -v : Be verbose [use twice -vv to be more verbose].
  3. -n : Use numeric-only IP addresses i.e. do not use DNS to resolve ip addresses.
  4. -w 1 : Set time out value to 1.

More examples:

$ netcat -z -vv http [] 80 (http) open
 sent 0, rcvd 0
$ netcat -z -vv https
DNS fwd/rev mismatch: !=
DNS fwd/rev mismatch: !=
DNS fwd/rev mismatch: !=
DNS fwd/rev mismatch: !=
DNS fwd/rev mismatch: !=
DNS fwd/rev mismatch: !=
DNS fwd/rev mismatch: !=
DNS fwd/rev mismatch: != [] 443 (https) open
 sent 0, rcvd 0
$ netcat -v -z -n -w 1 1-1023
(UNKNOWN) [] 989 (ftps-data) open
(UNKNOWN) [] 443 (https) open
(UNKNOWN) [] 53 (domain) open
See also

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin, DevOps engineer, and a trainer for the Linux operating system/Unix shell scripting. Get the latest tutorials on SysAdmin, Linux/Unix and open source topics via RSS/XML feed or weekly email newsletter.

Share this on (or read 9 comments/add one below):

9 comment

  1. I had to add verbosity (-v) to get the output as above. By default my version displayed nothing. (Talking of that, I couldn’t figure out how to get it’s version…)

  2. Hello,

    I run this command on my ubuntu server but I am not getting that kind of output as you provided here. When I am using -z option that time it is not giving any kind of output. If use -t or option then it is giving output for port range 1-100 .. output is :SSH-2.0-OpenSSH_5.1p1 Debian-5ubuntu1 only.

    I.e it is scanning for port 22 only.

    Could you please tell me why options are not running on Ubuntu ?

  3. I had to add -v for it to work for me

    nc -z -v 22
    Connection to 22 port [tcp/ssh] succeeded!

  4. Do more faster port-scan using gnu-parallel.

    time seq 65535 | parallel --pipe --cat -j200% -n1000 'nc -vz localhost $(head -n1 {})-$(tail -n1 {})'
    real    0m52.813s
    user    3m16.853s
    sys     0m7.860s


    time nc -vz localhost 1-65535
    real    1m49.139s
    user    1m44.407s
    sys     0m4.733s
  5. Hi, this is a great guide.
    However, when using netcat to conduct a port scan, the results can be lengthy. Is there any way to have netcat -zv [host] [port ranges] display only OPEN PORTS?

      1. Use grep.

        netcat -zv [host] [port ranges] 2>&1 | grep succeeded

        netcat -zv [host] [port ranges] |& grep succeeded

    Have a question? Post it on our forum!