Netcat Section 7 of 14

Flags & Options

Netcat offers a range of flags for controlling connections, data transfer, timeouts, and encryption. Different implementations (OpenBSD netcat, GNU netcat, Ncat) support slightly different flags. Below is a curated reference of the most useful flags with examples.

Connection & Listening Flags

-l

Listen mode — accept incoming connections (server)

nc -l -p 4444
-p <port>

Specify local port (for listening or source port)

nc -l -p 4444
-s <address>

Set source IP address

nc -s 10.0.0.1 10.0.0.2 4444
-u

Use UDP instead of TCP

nc -u 10.0.0.1 4444

Data Transfer Flags

-e <program>

Execute program after connection (rare in modern netcat)

nc -l -p 4444 -e /bin/bash
-c <command>

Execute shell command (ncat only)

ncat -l -p 4444 --exec "whoami"
-i <interval>

Wait interval between lines of text sent

nc -i 2 10.0.0.1 4444
-w <timeout>

Timeout for connections and final net read

nc -w 5 10.0.0.1 4444

Input/Output Flags

-i <file>

Read from file instead of stdin

nc 10.0.0.1 4444 < payload.txt
-o <file>

Save all output to file

nc 10.0.0.1 4444 > output.txt
-q <seconds>

Quit after EOF on stdin and delay

echo "test" | nc 10.0.0.1 4444 -q 1
-v

Verbose — show detailed connection info

nc -v 10.0.0.1 4444
-vv

Even more verbose

nc -vv 10.0.0.1 4444

DNS & Proxy Flags (ncat / netcat-openbsd)

--proxy <host:port>

Connect via SOCKS4/5 or HTTP proxy

nc --proxy 10.0.0.1:8080 10.0.0.2 80
--proxy-type <type>

Proxy type: socks4, socks5, or http

nc --proxy 10.0.0.1:8080 --proxy-type http example.com 80
-X <version>

Connect via SOCKS version (4 or 5)

nc -X 5 -x 10.0.0.1:1080 target.com 80
-x <address:port>

Set proxy server (SOCKS)

nc -x 10.0.0.1:1080 target.com 80

SSL/TLS Flags (ncat)

--ssl

Enable SSL/TLS encryption

nc --ssl 10.0.0.1 443
--ssl-verify

Verify SSL certificate

nc --ssl --ssl-verify 10.0.0.1 443
--ssl-cert <file>

Client certificate file

nc --ssl --ssl-cert client.crt 10.0.0.1 443
--ssl-key <file>

Client private key file

nc --ssl --ssl-key client.key 10.0.0.1 443
--ssl-cafile <file>

CA certificate bundle

nc --ssl --ssl-cafile ca.crt 10.0.0.1 443

Implementation Differences

Different distributions ship different netcat versions with varying flag support:

VersionCommonly Found OnKey Notes
OpenBSD netcatmacOS, FreeBSD, Debian/UbuntuNo -e flag. Use ncat or other tools for shell access.
GNU netcat (traditional)Older Linux distros, KaliHas -e flag but has known security issues.
Ncat (Nmap project)Kali, Parrot, manual installEnhanced, supports SSL, proxy, --exec, and --keep-open.
netcat-traditionalUbuntu/Debian (installable via apt)Classic version with -e. Install explicitly on newer distros.

Info

Always test flag availability on your target system: nc -h or man nc. Some flags like -e are intentionally omitted from secure implementations.
Next: Usage Examples Back