How to Test Port Connectivity with nc (netcat) on Linux

Updated: 28 September 2026 · Applies to: Ncat 7.92 (nmap-ncat) on AlmaLinux and Rocky Linux 9 and 10 and RHEL 9 and 10; OpenBSD netcat on Ubuntu 24.04 and 26.04 and Debian 13

nc (netcat) is the quickest way to check whether a port on another server can be reached, and to open a temporary port for a firewall test. Two versions are common and differ in a few options:

• AlmaLinux, Rocky Linux, RHEL: Ncat from the Nmap project. Install with dnf install nmap-ncat; the command is nc.
• Ubuntu, Debian: OpenBSD netcat, usually preinstalled. Otherwise apt install netcat-openbsd.

The older telnet client can do a basic port test too, but it is no longer installed by default and nc gives clearer results.

Test whether a TCP port is reachable

nc -zv -w 3 203.0.113.10 443

-z only connects and disconnects, -v prints the result, -w 3 gives up after 3 seconds. The answers mean:

• "Connected to" (Ncat) or "succeeded!" (OpenBSD): the port is open and something listens.
• "Connection refused": the server answered, but nothing listens on that port (or a firewall rejects it).
• Timeout: no answer at all. A firewall drops the traffic, or the address is wrong.

Open a test port (to check a firewall)

Before a service is installed, you can still check that the firewall lets its port through:

1. On the server, listen on the port (the -k keeps it open for more than one test):

   nc -lk 5555

2. From another machine, connect and type a line:

   nc -v 203.0.113.10 5555

   The text you type appears on the server. Stop both sides with Ctrl+C.

Remember to open the port in the server firewall for the test, and to close it again afterwards.

UDP ports

nc -zvu -w 3 203.0.113.10 53

UDP has no connection handshake, so a missing error does not prove the port is open. For a real UDP test, listen with nc -lu 5555 on the server, send a line with echo test | nc -u -w 1 203.0.113.10 5555 from the client, and check that it arrives.

Without nc installed

Bash can open a TCP connection by itself:

timeout 3 bash -c '</dev/tcp/203.0.113.10/443' && echo open || echo "closed or filtered"

Common problems

• "invalid option -- 'k'" or other option errors: you have another netcat variant. Check with nc -h, or install the one listed above.
• Works from the server itself, not from outside: the service listens only on 127.0.0.1, or a firewall blocks it. See troubleshooting connection refused.

Official documentation: Ncat users' guide and OpenBSD netcat manual.