diff options
Diffstat (limited to '')
| -rw-r--r-- | src/usr.bin/nc/nc.1 | 467 |
1 files changed, 0 insertions, 467 deletions
diff --git a/src/usr.bin/nc/nc.1 b/src/usr.bin/nc/nc.1 deleted file mode 100644 index 232b6f5b6e..0000000000 --- a/src/usr.bin/nc/nc.1 +++ /dev/null | |||
| @@ -1,467 +0,0 @@ | |||
| 1 | .\" $OpenBSD: nc.1,v 1.61 2012/07/07 15:33:02 haesbaert Exp $ | ||
| 2 | .\" | ||
| 3 | .\" Copyright (c) 1996 David Sacerdote | ||
| 4 | .\" All rights reserved. | ||
| 5 | .\" | ||
| 6 | .\" Redistribution and use in source and binary forms, with or without | ||
| 7 | .\" modification, are permitted provided that the following conditions | ||
| 8 | .\" are met: | ||
| 9 | .\" 1. Redistributions of source code must retain the above copyright | ||
| 10 | .\" notice, this list of conditions and the following disclaimer. | ||
| 11 | .\" 2. Redistributions in binary form must reproduce the above copyright | ||
| 12 | .\" notice, this list of conditions and the following disclaimer in the | ||
| 13 | .\" documentation and/or other materials provided with the distribution. | ||
| 14 | .\" 3. The name of the author may not be used to endorse or promote products | ||
| 15 | .\" derived from this software without specific prior written permission | ||
| 16 | .\" | ||
| 17 | .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | ||
| 18 | .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
| 19 | .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
| 20 | .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
| 21 | .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
| 22 | .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
| 23 | .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
| 24 | .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
| 25 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
| 26 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
| 27 | .\" | ||
| 28 | .Dd $Mdocdate: July 7 2012 $ | ||
| 29 | .Dt NC 1 | ||
| 30 | .Os | ||
| 31 | .Sh NAME | ||
| 32 | .Nm nc | ||
| 33 | .Nd arbitrary TCP and UDP connections and listens | ||
| 34 | .Sh SYNOPSIS | ||
| 35 | .Nm nc | ||
| 36 | .Bk -words | ||
| 37 | .Op Fl 46DdhklnrStUuvz | ||
| 38 | .Op Fl I Ar length | ||
| 39 | .Op Fl i Ar interval | ||
| 40 | .Op Fl O Ar length | ||
| 41 | .Op Fl P Ar proxy_username | ||
| 42 | .Op Fl p Ar source_port | ||
| 43 | .Op Fl s Ar source | ||
| 44 | .Op Fl T Ar toskeyword | ||
| 45 | .Op Fl V Ar rtable | ||
| 46 | .Op Fl w Ar timeout | ||
| 47 | .Op Fl X Ar proxy_protocol | ||
| 48 | .Oo Xo | ||
| 49 | .Fl x Ar proxy_address Ns Oo : Ns | ||
| 50 | .Ar port Oc | ||
| 51 | .Xc Oc | ||
| 52 | .Op Ar destination | ||
| 53 | .Op Ar port | ||
| 54 | .Ek | ||
| 55 | .Sh DESCRIPTION | ||
| 56 | The | ||
| 57 | .Nm | ||
| 58 | (or | ||
| 59 | .Nm netcat ) | ||
| 60 | utility is used for just about anything under the sun involving TCP, | ||
| 61 | UDP, or | ||
| 62 | .Ux Ns -domain | ||
| 63 | sockets. | ||
| 64 | It can open TCP connections, send UDP packets, listen on arbitrary | ||
| 65 | TCP and UDP ports, do port scanning, and deal with both IPv4 and | ||
| 66 | IPv6. | ||
| 67 | Unlike | ||
| 68 | .Xr telnet 1 , | ||
| 69 | .Nm | ||
| 70 | scripts nicely, and separates error messages onto standard error instead | ||
| 71 | of sending them to standard output, as | ||
| 72 | .Xr telnet 1 | ||
| 73 | does with some. | ||
| 74 | .Pp | ||
| 75 | Common uses include: | ||
| 76 | .Pp | ||
| 77 | .Bl -bullet -offset indent -compact | ||
| 78 | .It | ||
| 79 | simple TCP proxies | ||
| 80 | .It | ||
| 81 | shell-script based HTTP clients and servers | ||
| 82 | .It | ||
| 83 | network daemon testing | ||
| 84 | .It | ||
| 85 | a SOCKS or HTTP ProxyCommand for | ||
| 86 | .Xr ssh 1 | ||
| 87 | .It | ||
| 88 | and much, much more | ||
| 89 | .El | ||
| 90 | .Pp | ||
| 91 | The options are as follows: | ||
| 92 | .Bl -tag -width Ds | ||
| 93 | .It Fl 4 | ||
| 94 | Forces | ||
| 95 | .Nm | ||
| 96 | to use IPv4 addresses only. | ||
| 97 | .It Fl 6 | ||
| 98 | Forces | ||
| 99 | .Nm | ||
| 100 | to use IPv6 addresses only. | ||
| 101 | .It Fl D | ||
| 102 | Enable debugging on the socket. | ||
| 103 | .It Fl d | ||
| 104 | Do not attempt to read from stdin. | ||
| 105 | .It Fl h | ||
| 106 | Prints out | ||
| 107 | .Nm | ||
| 108 | help. | ||
| 109 | .It Fl I Ar length | ||
| 110 | Specifies the size of the TCP receive buffer. | ||
| 111 | .It Fl i Ar interval | ||
| 112 | Specifies a delay time interval between lines of text sent and received. | ||
| 113 | Also causes a delay time between connections to multiple ports. | ||
| 114 | .It Fl k | ||
| 115 | Forces | ||
| 116 | .Nm | ||
| 117 | to stay listening for another connection after its current connection | ||
| 118 | is completed. | ||
| 119 | It is an error to use this option without the | ||
| 120 | .Fl l | ||
| 121 | option. | ||
| 122 | When used together with the | ||
| 123 | .Fl u | ||
| 124 | option, the server socket is not connected and it can receive UDP datagrams from | ||
| 125 | multiple hosts. | ||
| 126 | .It Fl l | ||
| 127 | Used to specify that | ||
| 128 | .Nm | ||
| 129 | should listen for an incoming connection rather than initiate a | ||
| 130 | connection to a remote host. | ||
| 131 | It is an error to use this option in conjunction with the | ||
| 132 | .Fl p , | ||
| 133 | .Fl s , | ||
| 134 | or | ||
| 135 | .Fl z | ||
| 136 | options. | ||
| 137 | Additionally, any timeouts specified with the | ||
| 138 | .Fl w | ||
| 139 | option are ignored. | ||
| 140 | .It Fl n | ||
| 141 | Do not do any DNS or service lookups on any specified addresses, | ||
| 142 | hostnames or ports. | ||
| 143 | .It Fl O Ar length | ||
| 144 | Specifies the size of the TCP send buffer. | ||
| 145 | .It Fl P Ar proxy_username | ||
| 146 | Specifies a username to present to a proxy server that requires authentication. | ||
| 147 | If no username is specified then authentication will not be attempted. | ||
| 148 | Proxy authentication is only supported for HTTP CONNECT proxies at present. | ||
| 149 | .It Fl p Ar source_port | ||
| 150 | Specifies the source port | ||
| 151 | .Nm | ||
| 152 | should use, subject to privilege restrictions and availability. | ||
| 153 | It is an error to use this option in conjunction with the | ||
| 154 | .Fl l | ||
| 155 | option. | ||
| 156 | .It Fl r | ||
| 157 | Specifies that source and/or destination ports should be chosen randomly | ||
| 158 | instead of sequentially within a range or in the order that the system | ||
| 159 | assigns them. | ||
| 160 | .It Fl S | ||
| 161 | Enables the RFC 2385 TCP MD5 signature option. | ||
| 162 | .It Fl s Ar source | ||
| 163 | Specifies the IP of the interface which is used to send the packets. | ||
| 164 | For | ||
| 165 | .Ux Ns -domain | ||
| 166 | datagram sockets, specifies the local temporary socket file | ||
| 167 | to create and use so that datagrams can be received. | ||
| 168 | It is an error to use this option in conjunction with the | ||
| 169 | .Fl l | ||
| 170 | option. | ||
| 171 | .It Fl T Ar toskeyword | ||
| 172 | Change IPv4 TOS value. | ||
| 173 | .Ar toskeyword | ||
| 174 | may be one of | ||
| 175 | .Ar critical , | ||
| 176 | .Ar inetcontrol , | ||
| 177 | .Ar lowdelay , | ||
| 178 | .Ar netcontrol , | ||
| 179 | .Ar throughput , | ||
| 180 | .Ar reliability , | ||
| 181 | or one of the DiffServ Code Points: | ||
| 182 | .Ar ef , | ||
| 183 | .Ar af11 ... af43 , | ||
| 184 | .Ar cs0 ... cs7 ; | ||
| 185 | or a number in either hex or decimal. | ||
| 186 | .It Fl t | ||
| 187 | Causes | ||
| 188 | .Nm | ||
| 189 | to send RFC 854 DON'T and WON'T responses to RFC 854 DO and WILL requests. | ||
| 190 | This makes it possible to use | ||
| 191 | .Nm | ||
| 192 | to script telnet sessions. | ||
| 193 | .It Fl U | ||
| 194 | Specifies to use | ||
| 195 | .Ux Ns -domain | ||
| 196 | sockets. | ||
| 197 | .It Fl u | ||
| 198 | Use UDP instead of the default option of TCP. | ||
| 199 | For | ||
| 200 | .Ux Ns -domain | ||
| 201 | sockets, use a datagram socket instead of a stream socket. | ||
| 202 | If a | ||
| 203 | .Ux Ns -domain | ||
| 204 | socket is used, a temporary receiving socket is created in | ||
| 205 | .Pa /tmp | ||
| 206 | unless the | ||
| 207 | .Fl s | ||
| 208 | flag is given. | ||
| 209 | .It Fl V Ar rtable | ||
| 210 | Set the routing table to be used. | ||
| 211 | The default is 0. | ||
| 212 | .It Fl v | ||
| 213 | Have | ||
| 214 | .Nm | ||
| 215 | give more verbose output. | ||
| 216 | .It Fl w Ar timeout | ||
| 217 | Connections which cannot be established or are idle timeout after | ||
| 218 | .Ar timeout | ||
| 219 | seconds. | ||
| 220 | The | ||
| 221 | .Fl w | ||
| 222 | flag has no effect on the | ||
| 223 | .Fl l | ||
| 224 | option, i.e.\& | ||
| 225 | .Nm | ||
| 226 | will listen forever for a connection, with or without the | ||
| 227 | .Fl w | ||
| 228 | flag. | ||
| 229 | The default is no timeout. | ||
| 230 | .It Fl X Ar proxy_protocol | ||
| 231 | Requests that | ||
| 232 | .Nm | ||
| 233 | should use the specified protocol when talking to the proxy server. | ||
| 234 | Supported protocols are | ||
| 235 | .Dq 4 | ||
| 236 | (SOCKS v.4), | ||
| 237 | .Dq 5 | ||
| 238 | (SOCKS v.5) | ||
| 239 | and | ||
| 240 | .Dq connect | ||
| 241 | (HTTPS proxy). | ||
| 242 | If the protocol is not specified, SOCKS version 5 is used. | ||
| 243 | .It Xo | ||
| 244 | .Fl x Ar proxy_address Ns Oo : Ns | ||
| 245 | .Ar port Oc | ||
| 246 | .Xc | ||
| 247 | Requests that | ||
| 248 | .Nm | ||
| 249 | should connect to | ||
| 250 | .Ar destination | ||
| 251 | using a proxy at | ||
| 252 | .Ar proxy_address | ||
| 253 | and | ||
| 254 | .Ar port . | ||
| 255 | If | ||
| 256 | .Ar port | ||
| 257 | is not specified, the well-known port for the proxy protocol is used (1080 | ||
| 258 | for SOCKS, 3128 for HTTPS). | ||
| 259 | .It Fl z | ||
| 260 | Specifies that | ||
| 261 | .Nm | ||
| 262 | should just scan for listening daemons, without sending any data to them. | ||
| 263 | It is an error to use this option in conjunction with the | ||
| 264 | .Fl l | ||
| 265 | option. | ||
| 266 | .El | ||
| 267 | .Pp | ||
| 268 | .Ar destination | ||
| 269 | can be a numerical IP address or a symbolic hostname | ||
| 270 | (unless the | ||
| 271 | .Fl n | ||
| 272 | option is given). | ||
| 273 | In general, a destination must be specified, | ||
| 274 | unless the | ||
| 275 | .Fl l | ||
| 276 | option is given | ||
| 277 | (in which case the local host is used). | ||
| 278 | For | ||
| 279 | .Ux Ns -domain | ||
| 280 | sockets, a destination is required and is the socket path to connect to | ||
| 281 | (or listen on if the | ||
| 282 | .Fl l | ||
| 283 | option is given). | ||
| 284 | .Pp | ||
| 285 | .Ar port | ||
| 286 | can be a single integer or a range of ports. | ||
| 287 | Ranges are in the form nn-mm. | ||
| 288 | In general, | ||
| 289 | a destination port must be specified, | ||
| 290 | unless the | ||
| 291 | .Fl U | ||
| 292 | option is given. | ||
| 293 | .Sh CLIENT/SERVER MODEL | ||
| 294 | It is quite simple to build a very basic client/server model using | ||
| 295 | .Nm . | ||
| 296 | On one console, start | ||
| 297 | .Nm | ||
| 298 | listening on a specific port for a connection. | ||
| 299 | For example: | ||
| 300 | .Pp | ||
| 301 | .Dl $ nc -l 1234 | ||
| 302 | .Pp | ||
| 303 | .Nm | ||
| 304 | is now listening on port 1234 for a connection. | ||
| 305 | On a second console | ||
| 306 | .Pq or a second machine , | ||
| 307 | connect to the machine and port being listened on: | ||
| 308 | .Pp | ||
| 309 | .Dl $ nc 127.0.0.1 1234 | ||
| 310 | .Pp | ||
| 311 | There should now be a connection between the ports. | ||
| 312 | Anything typed at the second console will be concatenated to the first, | ||
| 313 | and vice-versa. | ||
| 314 | After the connection has been set up, | ||
| 315 | .Nm | ||
| 316 | does not really care which side is being used as a | ||
| 317 | .Sq server | ||
| 318 | and which side is being used as a | ||
| 319 | .Sq client . | ||
| 320 | The connection may be terminated using an | ||
| 321 | .Dv EOF | ||
| 322 | .Pq Sq ^D . | ||
| 323 | .Sh DATA TRANSFER | ||
| 324 | The example in the previous section can be expanded to build a | ||
| 325 | basic data transfer model. | ||
| 326 | Any information input into one end of the connection will be output | ||
| 327 | to the other end, and input and output can be easily captured in order to | ||
| 328 | emulate file transfer. | ||
| 329 | .Pp | ||
| 330 | Start by using | ||
| 331 | .Nm | ||
| 332 | to listen on a specific port, with output captured into a file: | ||
| 333 | .Pp | ||
| 334 | .Dl $ nc -l 1234 \*(Gt filename.out | ||
| 335 | .Pp | ||
| 336 | Using a second machine, connect to the listening | ||
| 337 | .Nm | ||
| 338 | process, feeding it the file which is to be transferred: | ||
| 339 | .Pp | ||
| 340 | .Dl $ nc host.example.com 1234 \*(Lt filename.in | ||
| 341 | .Pp | ||
| 342 | After the file has been transferred, the connection will close automatically. | ||
| 343 | .Sh TALKING TO SERVERS | ||
| 344 | It is sometimes useful to talk to servers | ||
| 345 | .Dq by hand | ||
| 346 | rather than through a user interface. | ||
| 347 | It can aid in troubleshooting, | ||
| 348 | when it might be necessary to verify what data a server is sending | ||
| 349 | in response to commands issued by the client. | ||
| 350 | For example, to retrieve the home page of a web site: | ||
| 351 | .Bd -literal -offset indent | ||
| 352 | $ printf "GET / HTTP/1.0\er\en\er\en" | nc host.example.com 80 | ||
| 353 | .Ed | ||
| 354 | .Pp | ||
| 355 | Note that this also displays the headers sent by the web server. | ||
| 356 | They can be filtered, using a tool such as | ||
| 357 | .Xr sed 1 , | ||
| 358 | if necessary. | ||
| 359 | .Pp | ||
| 360 | More complicated examples can be built up when the user knows the format | ||
| 361 | of requests required by the server. | ||
| 362 | As another example, an email may be submitted to an SMTP server using: | ||
| 363 | .Bd -literal -offset indent | ||
| 364 | $ nc localhost 25 \*(Lt\*(Lt EOF | ||
| 365 | HELO host.example.com | ||
| 366 | MAIL FROM:\*(Ltuser@host.example.com\*(Gt | ||
| 367 | RCPT TO:\*(Ltuser2@host.example.com\*(Gt | ||
| 368 | DATA | ||
| 369 | Body of email. | ||
| 370 | \&. | ||
| 371 | QUIT | ||
| 372 | EOF | ||
| 373 | .Ed | ||
| 374 | .Sh PORT SCANNING | ||
| 375 | It may be useful to know which ports are open and running services on | ||
| 376 | a target machine. | ||
| 377 | The | ||
| 378 | .Fl z | ||
| 379 | flag can be used to tell | ||
| 380 | .Nm | ||
| 381 | to report open ports, | ||
| 382 | rather than initiate a connection. | ||
| 383 | For example: | ||
| 384 | .Bd -literal -offset indent | ||
| 385 | $ nc -z host.example.com 20-30 | ||
| 386 | Connection to host.example.com 22 port [tcp/ssh] succeeded! | ||
| 387 | Connection to host.example.com 25 port [tcp/smtp] succeeded! | ||
| 388 | .Ed | ||
| 389 | .Pp | ||
| 390 | The port range was specified to limit the search to ports 20 \- 30. | ||
| 391 | .Pp | ||
| 392 | Alternatively, it might be useful to know which server software | ||
| 393 | is running, and which versions. | ||
| 394 | This information is often contained within the greeting banners. | ||
| 395 | In order to retrieve these, it is necessary to first make a connection, | ||
| 396 | and then break the connection when the banner has been retrieved. | ||
| 397 | This can be accomplished by specifying a small timeout with the | ||
| 398 | .Fl w | ||
| 399 | flag, or perhaps by issuing a | ||
| 400 | .Qq Dv QUIT | ||
| 401 | command to the server: | ||
| 402 | .Bd -literal -offset indent | ||
| 403 | $ echo "QUIT" | nc host.example.com 20-30 | ||
| 404 | SSH-1.99-OpenSSH_3.6.1p2 | ||
| 405 | Protocol mismatch. | ||
| 406 | 220 host.example.com IMS SMTP Receiver Version 0.84 Ready | ||
| 407 | .Ed | ||
| 408 | .Sh EXAMPLES | ||
| 409 | Open a TCP connection to port 42 of host.example.com, using port 31337 as | ||
| 410 | the source port, with a timeout of 5 seconds: | ||
| 411 | .Pp | ||
| 412 | .Dl $ nc -p 31337 -w 5 host.example.com 42 | ||
| 413 | .Pp | ||
| 414 | Open a UDP connection to port 53 of host.example.com: | ||
| 415 | .Pp | ||
| 416 | .Dl $ nc -u host.example.com 53 | ||
| 417 | .Pp | ||
| 418 | Open a TCP connection to port 42 of host.example.com using 10.1.2.3 as the | ||
| 419 | IP for the local end of the connection: | ||
| 420 | .Pp | ||
| 421 | .Dl $ nc -s 10.1.2.3 host.example.com 42 | ||
| 422 | .Pp | ||
| 423 | Create and listen on a | ||
| 424 | .Ux Ns -domain | ||
| 425 | stream socket: | ||
| 426 | .Pp | ||
| 427 | .Dl $ nc -lU /var/tmp/dsocket | ||
| 428 | .Pp | ||
| 429 | Connect to port 42 of host.example.com via an HTTP proxy at 10.2.3.4, | ||
| 430 | port 8080. | ||
| 431 | This example could also be used by | ||
| 432 | .Xr ssh 1 ; | ||
| 433 | see the | ||
| 434 | .Cm ProxyCommand | ||
| 435 | directive in | ||
| 436 | .Xr ssh_config 5 | ||
| 437 | for more information. | ||
| 438 | .Pp | ||
| 439 | .Dl $ nc -x10.2.3.4:8080 -Xconnect host.example.com 42 | ||
| 440 | .Pp | ||
| 441 | The same example again, this time enabling proxy authentication with username | ||
| 442 | .Dq ruser | ||
| 443 | if the proxy requires it: | ||
| 444 | .Pp | ||
| 445 | .Dl $ nc -x10.2.3.4:8080 -Xconnect -Pruser host.example.com 42 | ||
| 446 | .Sh SEE ALSO | ||
| 447 | .Xr cat 1 , | ||
| 448 | .Xr ssh 1 | ||
| 449 | .Sh AUTHORS | ||
| 450 | Original implementation by *Hobbit* | ||
| 451 | .Aq hobbit@avian.org . | ||
| 452 | .br | ||
| 453 | Rewritten with IPv6 support by | ||
| 454 | .An Eric Jackson Aq ericj@monkey.org . | ||
| 455 | .Sh CAVEATS | ||
| 456 | UDP port scans using the | ||
| 457 | .Fl uz | ||
| 458 | combination of flags will always report success irrespective of | ||
| 459 | the target machine's state. | ||
| 460 | However, | ||
| 461 | in conjunction with a traffic sniffer either on the target machine | ||
| 462 | or an intermediary device, | ||
| 463 | the | ||
| 464 | .Fl uz | ||
| 465 | combination could be useful for communications diagnostics. | ||
| 466 | Note that the amount of UDP traffic generated may be limited either | ||
| 467 | due to hardware resources and/or configuration settings. | ||
