Netcat Section 2 of 14

Installation

Netcat is available on nearly every operating system. Different implementations exist — OpenBSD netcat, GNU netcat, and Ncat (from the Nmap project) have slightly different features. This guide covers installation on Linux, macOS, Windows, and Docker.

Linux (Debian/Ubuntu/Kali)

Install netcat-openbsd (Recommended)

The OpenBSD version is most common on Debian-based systems. It provides the classic nc command with modern security.

bash

1sudo apt update && sudo apt install netcat-openbsd

Install ncat (Nmap project)

Ncat is the Nmap version — feature-rich with SSL, proxy, and --exec support. Install from the nmap package.

bash

1sudo apt update && sudo apt install ncat

Install traditional netcat (legacy)

GNU netcat-traditional includes the -e flag for shell execution but is no longer default on Debian/Ubuntu.

bash

1sudo apt update && sudo apt install netcat-traditional

Verify Installation

Check which netcat variant is installed and its version.

bash

1nc -h 2>&1 | head -n 5

Kali Linux

Netcat is Preinstalled

Kali ships with OpenBSD netcat (nc) and Ncat (ncat) by default. No installation needed.

bash

1which nc && which ncat

Install if missing

If for some reason netcat is not present, install both variants.

bash

1sudo apt update && sudo apt install netcat-openbsd ncat

macOS

Using Homebrew (Recommended)

macOS includes a BSD netcat, but Homebrew provides updated versions and ncat.

bash

1brew install netcat

Install Ncat via Homebrew

Nmap includes ncat; install via brew for SSL and proxy support.

bash

1brew install nmap

Verify Installation

macOS ships with BSD nc at /usr/bin/nc. Confirm with --help.

bash

1nc -h

Windows

Using Nmap for Windows

Download Nmap for Windows — it includes Ncat (ncat.exe). Add to PATH manually.

bash

1# Download: https://nmap.org/download.html

Using WSL2

If using Windows Subsystem for Linux, install the Linux netcat within WSL.

bash

1sudo apt install netcat-openbsd  # inside WSL

Docker

Run netcat in container

Use the alpine/netcat image to quickly spin up a test listener.

bash

1docker run --rm alpine/netcat -l -p 4444

Test connection from another container

Run a second netcat client container to connect to the listener.

bash

1docker run --rm alpine/netcat CONTAINER_IP 4444

Which Netcat Should I Use?

Understanding the variants helps you choose the right tool:

OpenBSD netcat (recommended for general use)

Most Linux distributions and macOS include this by default. Secure, lightweight, but lacks -e for shell execution. Use ncat or netcat-traditional when you need -e.

Ncat (Nmap project)

Feature-rich: SSL, proxy, --exec (replaces -e), keep-open for multi-connection, and more. Best for penetration testing and advanced scenarios. Install by installing Nmap.

GNU netcat-traditional (legacy)

The original netcat with -e support. Not installed by default on modern Debian/Ubuntu due to security concerns. Explicitly install if you need shell execution with classic nc.

Tip

On most modern Linux distros, nc points to OpenBSD netcat. If you need -e, install netcat-traditional or use ncat --exec instead.

Next: Basic Usage