How to Check if a Remote Port Is Open with nc (netcat)

Updated: 18 October 2026 · Applies to: Ncat 7.92 (nmap-ncat) on AlmaLinux 10.2, also used on Rocky Linux and RHEL; OpenBSD netcat on Debian 13 (1.229), Ubuntu 24.04 (1.226) and Ubuntu 26.04 (1.234)

To check whether a port on another server is open, run nc -zv -w 3 203.0.113.10 443 (use the server's address and port). -z only opens and closes the connection, -v prints the result and -w 3 gives up after 3 seconds. "Connected to" or "succeeded!" means the port is open, and the exit code is then 0.

Which nc do you have?

Two netcat versions are common, and their options and messages differ. Check with nc -h 2>&1 | head -1:

• AlmaLinux, Rocky Linux, RHEL: Ncat 7.92 ( https://nmap.org/ncat ). If nc is missing, install it with dnf install nmap-ncat.
• Ubuntu and Debian: OpenBSD netcat (Debian patchlevel 1.229-1). Ubuntu marks this package as important, so it is normally installed. On Debian it is optional: apt install netcat-openbsd.

If you get "nc: command not found", see how to install netcat on Linux.

Check if a TCP port is open

Lab output for an open port, first Ncat on AlmaLinux 10.2, then OpenBSD netcat on Debian 13:

$ nc -zv -w 3 127.0.0.1 8080
Ncat: Version 7.92 ( https://nmap.org/ncat )
Ncat: Connected to 127.0.0.1:8080.
Ncat: 0 bytes sent, 0 bytes received in 0.07 seconds.

$ nc -zv -w 3 127.0.0.1 8080
Connection to 127.0.0.1 8080 port [tcp/http-alt] succeeded!

What the other answers mean (Ncat message, then OpenBSD message, all from our tests):

• Connection refused (Ncat: Connection refused. or nc: connect to 127.0.0.1 port 8081 (tcp) failed: Connection refused): the server answered, but nothing listens on that port, or the service listens only on 127.0.0.1.
• Timeout (Ncat: TIMEOUT. or ... (tcp) timed out: Operation now in progress): no answer at all. A firewall drops the traffic, the address is wrong or the server is down.
• No route to host (Ncat: No route to host. or ... (tcp) failed: No route to host): in our lab, a firewall rule that rejects connections with an ICMP message gave this answer. It can also mean the address is not reachable at all.

Always add -w. Without it, Ncat gave up after 10 seconds in our test, but OpenBSD netcat was still waiting after 20 seconds.

In a script, use the exit code:

if nc -z -w 3 203.0.113.10 443; then echo open; else echo "closed or filtered"; fi

Check several ports or a range

OpenBSD netcat (Ubuntu, Debian) accepts a list or a range and prints one line per port. The exit code is 0 if at least one port was open:

nc -zv -w 3 203.0.113.10 80 443
nc -zv -w 3 203.0.113.10 20-25

Ncat refuses both (Got more than one port specification and Invalid port number "8079-8081"). Use a loop instead:

for p in 22 80 443; do nc -zv -w 3 203.0.113.10 $p; done

Connect to a port and talk to the service

Without -z, nc keeps the connection open and shows what the service sends. Press Ctrl+C to leave.

• An SSH port answers with its version line. Lab output: SSH-2.0-OpenSSH_9.9 (AlmaLinux 10.2) and SSH-2.0-OpenSSH_10.0p2 Debian-7+deb13u4 (Debian 13).

  nc -w 3 203.0.113.10 22 </dev/null

• A web server answers a request that you send through nc:

  printf 'HEAD / HTTP/1.0\r\n\r\n' | nc -w 3 203.0.113.10 80

  Lab output (start):

  HTTP/1.0 200 OK
  Content-type: text/html; charset=utf-8
  Content-Length: 267

Careful with localhost: it can resolve to the IPv6 address ::1 first. In our tests, a service that listened only on 127.0.0.1 gave nc: connect to localhost (::1) port 8080 (tcp) failed: Connection refused. Use the IP address or add -4.

Check a UDP port

nc -zvu -w 2 203.0.113.10 5353

UDP has no handshake, so this test can only prove that a port is closed. In our tests:

• A closed port sends back an ICMP error: Ncat prints Connection refused., OpenBSD netcat prints nothing; both exit with 1.
• An open port and a port whose packets a firewall drops look the same: Ncat prints UDP packet sent successfully, OpenBSD netcat prints succeeded!; both exit with 0.

For a real UDP test, listen on the server with nc -lu 5555, send a line from the client with echo hello | nc -u -w 1 203.0.113.10 5555, and check that "hello" appears on the server. Ncat cannot keep a UDP listener open for more than one client: -k fails with "UDP mode does not support the -k or --keep-open options".

Test a firewall before the service is installed

1. Open the port in the server firewall: firewall-cmd on RHEL, AlmaLinux and Rocky Linux or UFW on Ubuntu.
2. On the server, listen on the port: nc -l 5555
3. From another machine: nc -v 203.0.113.10 5555, then type a line and press Enter. It appears on the server. Stop both sides with Ctrl+C.
4. Close the port again if no service will use it.

Without nc

Bash can open a TCP connection by itself. It printed "open" for an open port and "closed or filtered" for a refused and a dropped port in our tests:

timeout 3 bash -c '</dev/tcp/203.0.113.10/443' && echo open || echo "closed or filtered"

The telnet client works too: see how to install telnet and test ports.

Related checks

• The port works locally but not from outside: troubleshooting connection refused from remote servers.
• Is something on this server listening on the port? See how to check if a port is in use and find the process using a port and stop it.
• Mail servers: port 25 is open on all Ucartz servers; to test it, see how to check that outgoing port 25 works.

Official documentation: Ncat users guide and OpenBSD netcat manual.