summaryrefslogtreecommitdiff
path: root/src/usr.bin/nc/nc.1
diff options
context:
space:
mode:
Diffstat (limited to 'src/usr.bin/nc/nc.1')
-rw-r--r--src/usr.bin/nc/nc.1420
1 files changed, 0 insertions, 420 deletions
diff --git a/src/usr.bin/nc/nc.1 b/src/usr.bin/nc/nc.1
deleted file mode 100644
index 75410e298d..0000000000
--- a/src/usr.bin/nc/nc.1
+++ /dev/null
@@ -1,420 +0,0 @@
1.\" $OpenBSD: nc.1,v 1.47 2008/05/06 16:21:03 jmc Exp $
2.\"
3.\" Copyright (c) 1996 David Sacerdote
4.\" All rights reserved.
5.\"
6.\" Redistribution and use in source and binary forms, with or without
7.\" modification, are permitted provided that the following conditions
8.\" are met:
9.\" 1. Redistributions of source code must retain the above copyright
10.\" notice, this list of conditions and the following disclaimer.
11.\" 2. Redistributions in binary form must reproduce the above copyright
12.\" notice, this list of conditions and the following disclaimer in the
13.\" documentation and/or other materials provided with the distribution.
14.\" 3. The name of the author may not be used to endorse or promote products
15.\" derived from this software without specific prior written permission
16.\"
17.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27.\"
28.Dd $Mdocdate: May 6 2008 $
29.Dt NC 1
30.Os
31.Sh NAME
32.Nm nc
33.Nd arbitrary TCP and UDP connections and listens
34.Sh SYNOPSIS
35.Nm nc
36.Bk -words
37.Op Fl 46DdhklnrStUuvz
38.Op Fl I Ar length
39.Op Fl i Ar interval
40.Op Fl O Ar length
41.Op Fl P Ar proxy_username
42.Op Fl p Ar source_port
43.Op Fl s Ar source_ip_address
44.Op Fl T Ar ToS
45.Op Fl w Ar timeout
46.Op Fl X Ar proxy_protocol
47.Oo Xo
48.Fl x Ar proxy_address Ns Oo : Ns
49.Ar port Oc Oc
50.Xc
51.Op Ar hostname
52.Op Ar port Ns Bq Ar s
53.Ek
54.Sh DESCRIPTION
55The
56.Nm
57(or
58.Nm netcat )
59utility is used for just about anything under the sun involving TCP
60or UDP.
61It can open TCP connections, send UDP packets, listen on arbitrary
62TCP and UDP ports, do port scanning, and deal with both IPv4 and
63IPv6.
64Unlike
65.Xr telnet 1 ,
66.Nm
67scripts nicely, and separates error messages onto standard error instead
68of sending them to standard output, as
69.Xr telnet 1
70does with some.
71.Pp
72Common uses include:
73.Pp
74.Bl -bullet -offset indent -compact
75.It
76simple TCP proxies
77.It
78shell-script based HTTP clients and servers
79.It
80network daemon testing
81.It
82a SOCKS or HTTP ProxyCommand for
83.Xr ssh 1
84.It
85and much, much more
86.El
87.Pp
88The options are as follows:
89.Bl -tag -width Ds
90.It Fl 4
91Forces
92.Nm
93to use IPv4 addresses only.
94.It Fl 6
95Forces
96.Nm
97to use IPv6 addresses only.
98.It Fl D
99Enable debugging on the socket.
100.It Fl d
101Do not attempt to read from stdin.
102.It Fl h
103Prints out
104.Nm
105help.
106.It Fl I Ar length
107Specifies the size of the TCP receive buffer.
108.It Fl i Ar interval
109Specifies a delay time interval between lines of text sent and received.
110Also causes a delay time between connections to multiple ports.
111.It Fl k
112Forces
113.Nm
114to stay listening for another connection after its current connection
115is completed.
116It is an error to use this option without the
117.Fl l
118option.
119.It Fl l
120Used to specify that
121.Nm
122should listen for an incoming connection rather than initiate a
123connection to a remote host.
124It is an error to use this option in conjunction with the
125.Fl p ,
126.Fl s ,
127or
128.Fl z
129options.
130Additionally, any timeouts specified with the
131.Fl w
132option are ignored.
133.It Fl n
134Do not do any DNS or service lookups on any specified addresses,
135hostnames or ports.
136.It Fl O Ar length
137Specifies the size of the TCP send buffer.
138.It Fl P Ar proxy_username
139Specifies a username to present to a proxy server that requires authentication.
140If no username is specified then authentication will not be attempted.
141Proxy authentication is only supported for HTTP CONNECT proxies at present.
142.It Fl p Ar source_port
143Specifies the source port
144.Nm
145should use, subject to privilege restrictions and availability.
146It is an error to use this option in conjunction with the
147.Fl l
148option.
149.It Fl r
150Specifies that source and/or destination ports should be chosen randomly
151instead of sequentially within a range or in the order that the system
152assigns them.
153.It Fl S
154Enables the RFC 2385 TCP MD5 signature option.
155.It Fl s Ar source_ip_address
156Specifies the IP of the interface which is used to send the packets.
157It is an error to use this option in conjunction with the
158.Fl l
159option.
160.It Fl T Ar ToS
161Specifies IP Type of Service (ToS) for the connection.
162Valid values are the tokens
163.Dq lowdelay ,
164.Dq throughput ,
165.Dq reliability ,
166or an 8-bit hexadecimal value preceded by
167.Dq 0x .
168.It Fl t
169Causes
170.Nm
171to send RFC 854 DON'T and WON'T responses to RFC 854 DO and WILL requests.
172This makes it possible to use
173.Nm
174to script telnet sessions.
175.It Fl U
176Specifies to use Unix Domain Sockets.
177.It Fl u
178Use UDP instead of the default option of TCP.
179.It Fl v
180Have
181.Nm
182give more verbose output.
183.It Fl w Ar timeout
184If a connection and stdin are idle for more than
185.Ar timeout
186seconds, then the connection is silently closed.
187The
188.Fl w
189flag has no effect on the
190.Fl l
191option, i.e.\&
192.Nm
193will listen forever for a connection, with or without the
194.Fl w
195flag.
196The default is no timeout.
197.It Fl X Ar proxy_protocol
198Requests that
199.Nm
200should use the specified protocol when talking to the proxy server.
201Supported protocols are
202.Dq 4
203(SOCKS v.4),
204.Dq 5
205(SOCKS v.5)
206and
207.Dq connect
208(HTTPS proxy).
209If the protocol is not specified, SOCKS version 5 is used.
210.It Xo
211.Fl x Ar proxy_address Ns Oo : Ns
212.Ar port Oc
213.Xc
214Requests that
215.Nm
216should connect to
217.Ar hostname
218using a proxy at
219.Ar proxy_address
220and
221.Ar port .
222If
223.Ar port
224is not specified, the well-known port for the proxy protocol is used (1080
225for SOCKS, 3128 for HTTPS).
226.It Fl z
227Specifies that
228.Nm
229should just scan for listening daemons, without sending any data to them.
230It is an error to use this option in conjunction with the
231.Fl l
232option.
233.El
234.Pp
235.Ar hostname
236can be a numerical IP address or a symbolic hostname
237(unless the
238.Fl n
239option is given).
240In general, a hostname must be specified,
241unless the
242.Fl l
243option is given
244(in which case the local host is used).
245.Pp
246.Ar port Ns Op Ar s
247can be single integers or ranges.
248Ranges are in the form nn-mm.
249In general,
250a destination port must be specified,
251unless the
252.Fl U
253option is given
254(in which case a socket must be specified).
255.Sh CLIENT/SERVER MODEL
256It is quite simple to build a very basic client/server model using
257.Nm .
258On one console, start
259.Nm
260listening on a specific port for a connection.
261For example:
262.Pp
263.Dl $ nc -l 1234
264.Pp
265.Nm
266is now listening on port 1234 for a connection.
267On a second console
268.Pq or a second machine ,
269connect to the machine and port being listened on:
270.Pp
271.Dl $ nc 127.0.0.1 1234
272.Pp
273There should now be a connection between the ports.
274Anything typed at the second console will be concatenated to the first,
275and vice-versa.
276After the connection has been set up,
277.Nm
278does not really care which side is being used as a
279.Sq server
280and which side is being used as a
281.Sq client .
282The connection may be terminated using an
283.Dv EOF
284.Pq Sq ^D .
285.Sh DATA TRANSFER
286The example in the previous section can be expanded to build a
287basic data transfer model.
288Any information input into one end of the connection will be output
289to the other end, and input and output can be easily captured in order to
290emulate file transfer.
291.Pp
292Start by using
293.Nm
294to listen on a specific port, with output captured into a file:
295.Pp
296.Dl $ nc -l 1234 \*(Gt filename.out
297.Pp
298Using a second machine, connect to the listening
299.Nm
300process, feeding it the file which is to be transferred:
301.Pp
302.Dl $ nc host.example.com 1234 \*(Lt filename.in
303.Pp
304After the file has been transferred, the connection will close automatically.
305.Sh TALKING TO SERVERS
306It is sometimes useful to talk to servers
307.Dq by hand
308rather than through a user interface.
309It can aid in troubleshooting,
310when it might be necessary to verify what data a server is sending
311in response to commands issued by the client.
312For example, to retrieve the home page of a web site:
313.Bd -literal -offset indent
314$ echo -n "GET / HTTP/1.0\er\en\er\en" | nc host.example.com 80
315.Ed
316.Pp
317Note that this also displays the headers sent by the web server.
318They can be filtered, using a tool such as
319.Xr sed 1 ,
320if necessary.
321.Pp
322More complicated examples can be built up when the user knows the format
323of requests required by the server.
324As another example, an email may be submitted to an SMTP server using:
325.Bd -literal -offset indent
326$ nc localhost 25 \*(Lt\*(Lt EOF
327HELO host.example.com
328MAIL FROM:\*(Ltuser@host.example.com\*(Gt
329RCPT TO:\*(Ltuser2@host.example.com\*(Gt
330DATA
331Body of email.
332\&.
333QUIT
334EOF
335.Ed
336.Sh PORT SCANNING
337It may be useful to know which ports are open and running services on
338a target machine.
339The
340.Fl z
341flag can be used to tell
342.Nm
343to report open ports,
344rather than initiate a connection.
345For example:
346.Bd -literal -offset indent
347$ nc -z host.example.com 20-30
348Connection to host.example.com 22 port [tcp/ssh] succeeded!
349Connection to host.example.com 25 port [tcp/smtp] succeeded!
350.Ed
351.Pp
352The port range was specified to limit the search to ports 20 \- 30.
353.Pp
354Alternatively, it might be useful to know which server software
355is running, and which versions.
356This information is often contained within the greeting banners.
357In order to retrieve these, it is necessary to first make a connection,
358and then break the connection when the banner has been retrieved.
359This can be accomplished by specifying a small timeout with the
360.Fl w
361flag, or perhaps by issuing a
362.Qq Dv QUIT
363command to the server:
364.Bd -literal -offset indent
365$ echo "QUIT" | nc host.example.com 20-30
366SSH-1.99-OpenSSH_3.6.1p2
367Protocol mismatch.
368220 host.example.com IMS SMTP Receiver Version 0.84 Ready
369.Ed
370.Sh EXAMPLES
371Open a TCP connection to port 42 of host.example.com, using port 31337 as
372the source port, with a timeout of 5 seconds:
373.Pp
374.Dl $ nc -p 31337 -w 5 host.example.com 42
375.Pp
376Open a UDP connection to port 53 of host.example.com:
377.Pp
378.Dl $ nc -u host.example.com 53
379.Pp
380Open a TCP connection to port 42 of host.example.com using 10.1.2.3 as the
381IP for the local end of the connection:
382.Pp
383.Dl $ nc -s 10.1.2.3 host.example.com 42
384.Pp
385Create and listen on a Unix Domain Socket:
386.Pp
387.Dl $ nc -lU /var/tmp/dsocket
388.Pp
389Connect to port 42 of host.example.com via an HTTP proxy at 10.2.3.4,
390port 8080.
391This example could also be used by
392.Xr ssh 1 ;
393see the
394.Cm ProxyCommand
395directive in
396.Xr ssh_config 5
397for more information.
398.Pp
399.Dl $ nc -x10.2.3.4:8080 -Xconnect host.example.com 42
400.Pp
401The same example again, this time enabling proxy authentication with username
402.Dq ruser
403if the proxy requires it:
404.Pp
405.Dl $ nc -x10.2.3.4:8080 -Xconnect -Pruser host.example.com 42
406.Sh SEE ALSO
407.Xr cat 1 ,
408.Xr ssh 1
409.Sh AUTHORS
410Original implementation by *Hobbit*
411.Aq hobbit@avian.org .
412.br
413Rewritten with IPv6 support by
414.An Eric Jackson Aq ericj@monkey.org .
415.Sh CAVEATS
416UDP port scans will always succeed
417(i.e. report the port as open),
418rendering the
419.Fl uz
420combination of flags relatively useless.