How to Test If a Port Is Open with nc (Netcat)

By Ravindra Bagale, Cyber Security trainer LinkedIn Published: 27 October 2026 Last updated: 27 October 2026

From a machine you control, run nc -zv HOST PORT. "succeeded" means the TCP handshake completed. "refused" or timeout means closed or filtered. Only test hosts in your permission scope.

Quick answer

nc -zv 192.168.56.20 22
nc -zv 192.168.56.20 443
timeout 3 nc -zv 192.168.56.20 3389

Why use nc for one port?

Sometimes you only need a yes/no: "Can my laptop reach port 443 on the new EC2?" Netcat answers in a second. Yuki in Tokyo and Imran in Bhopal use it during go-live checks.

What does a connect test prove?

A completed TCP handshake. It does not prove TLS is healthy or that HTTP returns 200. Pair with curl -I for web ports.

How do I test step by step?

From your admin laptop:

nc -zv 192.168.56.20 22

Ncat: Connected to 192.168.56.20:22.
Ncat: 0 bytes sent, 0 bytes received in 0.01 seconds.

What it means: SSH port accepted a TCP connect from your machine.

Closed port example:
```
nc -zv 192.168.56.20 81
```
```
Ncat: Connection refused.
```
What it means: Host answered, but nothing listens on 81.
Filtered / timeout example:
```
timeout 3 nc -zv 203.0.113.10 445 || echo "timed out or failed"
```
What it means: No useful reply in 3 seconds — often a firewall drop. Do not keep hammering.
On the server, confirm with sudo ss -tulpn (see the open ports guide).

Ravindra Bagale's Tip

Timeout usually means a firewall dropped the packet. "Connection refused" usually means nothing is listening. Learn that difference before you open more security-group rules.

Quick quiz: check what you learned

Which flags make a verbose TCP connect test?
1. nc -zv host port
2. nc -e shell host
3. nc -l -p 4444 open
4. nc without any host
Show answer
A. -z scan mode; -v verbose. Only on allowed hosts.
Connection refused usually means:
1. Host up but nothing listening on that port
2. Your disk is full on the client machine
3. DNSSEC validation failed for the name
4. HTML markup is wrong in a web page
Show answer
A. TCP RST from host: port closed or filtered to refuse.

Learn it properly

This guide is the short path. These pages go deeper, with labs:

Frequently asked questions

What does nc -zv do?

Netcat tries a TCP connect (-z scan mode) and prints verbosely (-v).

nc not found?

Install nmap-ncat or netcat-openbsd; or use timeout bash /dev/tcp/HOST/PORT.

Is this the same as Nmap?

Nc checks one port quickly. Nmap maps many ports and services.

Can I test UDP?

UDP is harder; nmap -sU is the usual next step in a lab.

Related lesson?

Cyber 36.4 Netcat and Socat.