summaryrefslogtreecommitdiff
path: root/src/usr.bin/nc/nc.1
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--src/usr.bin/nc/nc.1467
1 files changed, 0 insertions, 467 deletions
diff --git a/src/usr.bin/nc/nc.1 b/src/usr.bin/nc/nc.1
deleted file mode 100644
index 232b6f5b6e..0000000000
--- a/src/usr.bin/nc/nc.1
+++ /dev/null
@@ -1,467 +0,0 @@
1.\" $OpenBSD: nc.1,v 1.61 2012/07/07 15:33:02 haesbaert Exp $
2.\"
3.\" Copyright (c) 1996 David Sacerdote
4.\" All rights reserved.
5.\"
6.\" Redistribution and use in source and binary forms, with or without
7.\" modification, are permitted provided that the following conditions
8.\" are met:
9.\" 1. Redistributions of source code must retain the above copyright
10.\" notice, this list of conditions and the following disclaimer.
11.\" 2. Redistributions in binary form must reproduce the above copyright
12.\" notice, this list of conditions and the following disclaimer in the
13.\" documentation and/or other materials provided with the distribution.
14.\" 3. The name of the author may not be used to endorse or promote products
15.\" derived from this software without specific prior written permission
16.\"
17.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27.\"
28.Dd $Mdocdate: July 7 2012 $
29.Dt NC 1
30.Os
31.Sh NAME
32.Nm nc
33.Nd arbitrary TCP and UDP connections and listens
34.Sh SYNOPSIS
35.Nm nc
36.Bk -words
37.Op Fl 46DdhklnrStUuvz
38.Op Fl I Ar length
39.Op Fl i Ar interval
40.Op Fl O Ar length
41.Op Fl P Ar proxy_username
42.Op Fl p Ar source_port
43.Op Fl s Ar source
44.Op Fl T Ar toskeyword
45.Op Fl V Ar rtable
46.Op Fl w Ar timeout
47.Op Fl X Ar proxy_protocol
48.Oo Xo
49.Fl x Ar proxy_address Ns Oo : Ns
50.Ar port Oc
51.Xc Oc
52.Op Ar destination
53.Op Ar port
54.Ek
55.Sh DESCRIPTION
56The
57.Nm
58(or
59.Nm netcat )
60utility is used for just about anything under the sun involving TCP,
61UDP, or
62.Ux Ns -domain
63sockets.
64It can open TCP connections, send UDP packets, listen on arbitrary
65TCP and UDP ports, do port scanning, and deal with both IPv4 and
66IPv6.
67Unlike
68.Xr telnet 1 ,
69.Nm
70scripts nicely, and separates error messages onto standard error instead
71of sending them to standard output, as
72.Xr telnet 1
73does with some.
74.Pp
75Common uses include:
76.Pp
77.Bl -bullet -offset indent -compact
78.It
79simple TCP proxies
80.It
81shell-script based HTTP clients and servers
82.It
83network daemon testing
84.It
85a SOCKS or HTTP ProxyCommand for
86.Xr ssh 1
87.It
88and much, much more
89.El
90.Pp
91The options are as follows:
92.Bl -tag -width Ds
93.It Fl 4
94Forces
95.Nm
96to use IPv4 addresses only.
97.It Fl 6
98Forces
99.Nm
100to use IPv6 addresses only.
101.It Fl D
102Enable debugging on the socket.
103.It Fl d
104Do not attempt to read from stdin.
105.It Fl h
106Prints out
107.Nm
108help.
109.It Fl I Ar length
110Specifies the size of the TCP receive buffer.
111.It Fl i Ar interval
112Specifies a delay time interval between lines of text sent and received.
113Also causes a delay time between connections to multiple ports.
114.It Fl k
115Forces
116.Nm
117to stay listening for another connection after its current connection
118is completed.
119It is an error to use this option without the
120.Fl l
121option.
122When used together with the
123.Fl u
124option, the server socket is not connected and it can receive UDP datagrams from
125multiple hosts.
126.It Fl l
127Used to specify that
128.Nm
129should listen for an incoming connection rather than initiate a
130connection to a remote host.
131It is an error to use this option in conjunction with the
132.Fl p ,
133.Fl s ,
134or
135.Fl z
136options.
137Additionally, any timeouts specified with the
138.Fl w
139option are ignored.
140.It Fl n
141Do not do any DNS or service lookups on any specified addresses,
142hostnames or ports.
143.It Fl O Ar length
144Specifies the size of the TCP send buffer.
145.It Fl P Ar proxy_username
146Specifies a username to present to a proxy server that requires authentication.
147If no username is specified then authentication will not be attempted.
148Proxy authentication is only supported for HTTP CONNECT proxies at present.
149.It Fl p Ar source_port
150Specifies the source port
151.Nm
152should use, subject to privilege restrictions and availability.
153It is an error to use this option in conjunction with the
154.Fl l
155option.
156.It Fl r
157Specifies that source and/or destination ports should be chosen randomly
158instead of sequentially within a range or in the order that the system
159assigns them.
160.It Fl S
161Enables the RFC 2385 TCP MD5 signature option.
162.It Fl s Ar source
163Specifies the IP of the interface which is used to send the packets.
164For
165.Ux Ns -domain
166datagram sockets, specifies the local temporary socket file
167to create and use so that datagrams can be received.
168It is an error to use this option in conjunction with the
169.Fl l
170option.
171.It Fl T Ar toskeyword
172Change IPv4 TOS value.
173.Ar toskeyword
174may be one of
175.Ar critical ,
176.Ar inetcontrol ,
177.Ar lowdelay ,
178.Ar netcontrol ,
179.Ar throughput ,
180.Ar reliability ,
181or one of the DiffServ Code Points:
182.Ar ef ,
183.Ar af11 ... af43 ,
184.Ar cs0 ... cs7 ;
185or a number in either hex or decimal.
186.It Fl t
187Causes
188.Nm
189to send RFC 854 DON'T and WON'T responses to RFC 854 DO and WILL requests.
190This makes it possible to use
191.Nm
192to script telnet sessions.
193.It Fl U
194Specifies to use
195.Ux Ns -domain
196sockets.
197.It Fl u
198Use UDP instead of the default option of TCP.
199For
200.Ux Ns -domain
201sockets, use a datagram socket instead of a stream socket.
202If a
203.Ux Ns -domain
204socket is used, a temporary receiving socket is created in
205.Pa /tmp
206unless the
207.Fl s
208flag is given.
209.It Fl V Ar rtable
210Set the routing table to be used.
211The default is 0.
212.It Fl v
213Have
214.Nm
215give more verbose output.
216.It Fl w Ar timeout
217Connections which cannot be established or are idle timeout after
218.Ar timeout
219seconds.
220The
221.Fl w
222flag has no effect on the
223.Fl l
224option, i.e.\&
225.Nm
226will listen forever for a connection, with or without the
227.Fl w
228flag.
229The default is no timeout.
230.It Fl X Ar proxy_protocol
231Requests that
232.Nm
233should use the specified protocol when talking to the proxy server.
234Supported protocols are
235.Dq 4
236(SOCKS v.4),
237.Dq 5
238(SOCKS v.5)
239and
240.Dq connect
241(HTTPS proxy).
242If the protocol is not specified, SOCKS version 5 is used.
243.It Xo
244.Fl x Ar proxy_address Ns Oo : Ns
245.Ar port Oc
246.Xc
247Requests that
248.Nm
249should connect to
250.Ar destination
251using a proxy at
252.Ar proxy_address
253and
254.Ar port .
255If
256.Ar port
257is not specified, the well-known port for the proxy protocol is used (1080
258for SOCKS, 3128 for HTTPS).
259.It Fl z
260Specifies that
261.Nm
262should just scan for listening daemons, without sending any data to them.
263It is an error to use this option in conjunction with the
264.Fl l
265option.
266.El
267.Pp
268.Ar destination
269can be a numerical IP address or a symbolic hostname
270(unless the
271.Fl n
272option is given).
273In general, a destination must be specified,
274unless the
275.Fl l
276option is given
277(in which case the local host is used).
278For
279.Ux Ns -domain
280sockets, a destination is required and is the socket path to connect to
281(or listen on if the
282.Fl l
283option is given).
284.Pp
285.Ar port
286can be a single integer or a range of ports.
287Ranges are in the form nn-mm.
288In general,
289a destination port must be specified,
290unless the
291.Fl U
292option is given.
293.Sh CLIENT/SERVER MODEL
294It is quite simple to build a very basic client/server model using
295.Nm .
296On one console, start
297.Nm
298listening on a specific port for a connection.
299For example:
300.Pp
301.Dl $ nc -l 1234
302.Pp
303.Nm
304is now listening on port 1234 for a connection.
305On a second console
306.Pq or a second machine ,
307connect to the machine and port being listened on:
308.Pp
309.Dl $ nc 127.0.0.1 1234
310.Pp
311There should now be a connection between the ports.
312Anything typed at the second console will be concatenated to the first,
313and vice-versa.
314After the connection has been set up,
315.Nm
316does not really care which side is being used as a
317.Sq server
318and which side is being used as a
319.Sq client .
320The connection may be terminated using an
321.Dv EOF
322.Pq Sq ^D .
323.Sh DATA TRANSFER
324The example in the previous section can be expanded to build a
325basic data transfer model.
326Any information input into one end of the connection will be output
327to the other end, and input and output can be easily captured in order to
328emulate file transfer.
329.Pp
330Start by using
331.Nm
332to listen on a specific port, with output captured into a file:
333.Pp
334.Dl $ nc -l 1234 \*(Gt filename.out
335.Pp
336Using a second machine, connect to the listening
337.Nm
338process, feeding it the file which is to be transferred:
339.Pp
340.Dl $ nc host.example.com 1234 \*(Lt filename.in
341.Pp
342After the file has been transferred, the connection will close automatically.
343.Sh TALKING TO SERVERS
344It is sometimes useful to talk to servers
345.Dq by hand
346rather than through a user interface.
347It can aid in troubleshooting,
348when it might be necessary to verify what data a server is sending
349in response to commands issued by the client.
350For example, to retrieve the home page of a web site:
351.Bd -literal -offset indent
352$ printf "GET / HTTP/1.0\er\en\er\en" | nc host.example.com 80
353.Ed
354.Pp
355Note that this also displays the headers sent by the web server.
356They can be filtered, using a tool such as
357.Xr sed 1 ,
358if necessary.
359.Pp
360More complicated examples can be built up when the user knows the format
361of requests required by the server.
362As another example, an email may be submitted to an SMTP server using:
363.Bd -literal -offset indent
364$ nc localhost 25 \*(Lt\*(Lt EOF
365HELO host.example.com
366MAIL FROM:\*(Ltuser@host.example.com\*(Gt
367RCPT TO:\*(Ltuser2@host.example.com\*(Gt
368DATA
369Body of email.
370\&.
371QUIT
372EOF
373.Ed
374.Sh PORT SCANNING
375It may be useful to know which ports are open and running services on
376a target machine.
377The
378.Fl z
379flag can be used to tell
380.Nm
381to report open ports,
382rather than initiate a connection.
383For example:
384.Bd -literal -offset indent
385$ nc -z host.example.com 20-30
386Connection to host.example.com 22 port [tcp/ssh] succeeded!
387Connection to host.example.com 25 port [tcp/smtp] succeeded!
388.Ed
389.Pp
390The port range was specified to limit the search to ports 20 \- 30.
391.Pp
392Alternatively, it might be useful to know which server software
393is running, and which versions.
394This information is often contained within the greeting banners.
395In order to retrieve these, it is necessary to first make a connection,
396and then break the connection when the banner has been retrieved.
397This can be accomplished by specifying a small timeout with the
398.Fl w
399flag, or perhaps by issuing a
400.Qq Dv QUIT
401command to the server:
402.Bd -literal -offset indent
403$ echo "QUIT" | nc host.example.com 20-30
404SSH-1.99-OpenSSH_3.6.1p2
405Protocol mismatch.
406220 host.example.com IMS SMTP Receiver Version 0.84 Ready
407.Ed
408.Sh EXAMPLES
409Open a TCP connection to port 42 of host.example.com, using port 31337 as
410the source port, with a timeout of 5 seconds:
411.Pp
412.Dl $ nc -p 31337 -w 5 host.example.com 42
413.Pp
414Open a UDP connection to port 53 of host.example.com:
415.Pp
416.Dl $ nc -u host.example.com 53
417.Pp
418Open a TCP connection to port 42 of host.example.com using 10.1.2.3 as the
419IP for the local end of the connection:
420.Pp
421.Dl $ nc -s 10.1.2.3 host.example.com 42
422.Pp
423Create and listen on a
424.Ux Ns -domain
425stream socket:
426.Pp
427.Dl $ nc -lU /var/tmp/dsocket
428.Pp
429Connect to port 42 of host.example.com via an HTTP proxy at 10.2.3.4,
430port 8080.
431This example could also be used by
432.Xr ssh 1 ;
433see the
434.Cm ProxyCommand
435directive in
436.Xr ssh_config 5
437for more information.
438.Pp
439.Dl $ nc -x10.2.3.4:8080 -Xconnect host.example.com 42
440.Pp
441The same example again, this time enabling proxy authentication with username
442.Dq ruser
443if the proxy requires it:
444.Pp
445.Dl $ nc -x10.2.3.4:8080 -Xconnect -Pruser host.example.com 42
446.Sh SEE ALSO
447.Xr cat 1 ,
448.Xr ssh 1
449.Sh AUTHORS
450Original implementation by *Hobbit*
451.Aq hobbit@avian.org .
452.br
453Rewritten with IPv6 support by
454.An Eric Jackson Aq ericj@monkey.org .
455.Sh CAVEATS
456UDP port scans using the
457.Fl uz
458combination of flags will always report success irrespective of
459the target machine's state.
460However,
461in conjunction with a traffic sniffer either on the target machine
462or an intermediary device,
463the
464.Fl uz
465combination could be useful for communications diagnostics.
466Note that the amount of UDP traffic generated may be limited either
467due to hardware resources and/or configuration settings.