Notified only about genuinely open connections. Suppresses diagnostic messages about refused connections, unless -v is The same batch of data from standard input to each One port is thus specified, netcat connects to all of them, sending Parse those, so specify ranges using numbers if you can. etc/services contain hyphens - netcat currently will not correctly Netcat accepts its commands with options first, then the target host,Īnd everything thereafter is interpreted as port names or numbers, or 'Port-scanning is a popular method for exploring what's out there. This may answer your question netcat can do some port scanning: If you want to identify the kinds of servers a host is running, nmap is a much better tool as it's kept current with the various fingerprints of common servers you're likely to encounter. Netcat is really the wrong tool for this job, however. You'll have to discover and understand the protocols of mail servers and ssh servers if you want to query them in a similar fashion. If not, it may not be running a typical web server. If this comes back with a response containing HTTP/1.0 200 OK, it's running a web server on port 80. echo -e 'GET HTTP/1.0 ' | nc 80 | less

Here's a simple example of how I'd determine if was hosting a live web server using netcat. You have to know what port a web server runs on, the name of the server, the protocol, everything. That means you have to understand http if you want to find out if it's running a web server, smtp if it's running a mail sender, etc.

To use netcat to learn more, you need to pass it the correct data to elicit a valid response. This will tell you if it's listening on port 80, the web port, but it won't tell you anything else about the server. Using netcat, you can query a server like this: nc -z 80 To identify if a server is running, you only need to determine if the port is open for requests.

Netcat windows commands