At work, the infrastructure team is rolling out new VMs with RHEL7 installed as the base OS. This particular image comes with the nmap-ncat version of Netcat and does not have NMap installed. We are precluded from installing anything on the machines.

Previously, we were using the GNU Netcat which have the -z option to scan a remote host/port to check if it was open. Something like this:

nc -z -v -w 3 remote.host.name 1234

How can I achieve the same check with the new ncat which does not have the -z option on a system where I cannot install nmap?

  • 1
    Why are you checking to see if a port is open/closed? Is this part of a monitoring solution?
    – ewwhite
    Jul 9, 2016 at 21:19
  • 1
    We're working on getting -z into Ncat, but it won't be in Red Hat for a while, I'm sure: github.com/nmap/nmap/pull/444 Jul 11, 2016 at 16:32
  • @ewwhite I have to check if network ACLs are open between point A and point B. For instance: can the app server talk TCP to the DB server on port 1521. Jun 14, 2017 at 23:00

3 Answers 3


Bash allows you to connect to TCP and/or UDP ports by redirecting to special files:

/dev/tcp/host/port If host is a valid hostname or Internet address, and port is an integer port number or service name, Bash attempts to open the corresponding TCP socket.

/dev/udp/host/port If host is a valid hostname or Internet address, and port is an integer port number or service name, Bash attempts to open the corresponding UDP socket.

A failure to open or create a file causes the redirection to fail.

So to test if you can connect to port 80 on www.example.com the following should work:

echo -n > /dev/tcp/www.example.com/80

If the port is blocked you either get a "connection refused" message or a timeout.

  • 1
    You can telnet to the port too Jul 10, 2016 at 1:03
  • Yes, but a minimal install in RHEL 7 does not include the telnet RPM where bash is always present.
    – HBruijn
    Jul 10, 2016 at 8:41
  • 2
    Really? How things have changed. Jul 10, 2016 at 12:38
  • 1
    @RyanBabchishin plus lots of security guidelines require removal of the telnet client on the basis that using it to log in to something else is insecure; ignoring its vast troubleshooting uses. Jan 8, 2017 at 2:27
  • @JasonMartin Pfft Jan 8, 2017 at 14:29

Though Ncat does not yet support -z, you can get the same behavior with shell redirection:

$ ncat google.com 80 </dev/null >/dev/null && echo "yes"
$ ncat google.com 81 </dev/null >/dev/null && echo "yes"
Ncat: Connection timed out.
$ ncat scanme.nmap.org 1234 </dev/null >/dev/null && echo "yes"
Ncat: Connection refused.

The connect timeout can be adjusted with the -w option.

EDIT: Ncat 7.25BETA2 introduced the -z option which works as it does with GNU netcat, but only on single ports. If you need to scan port ranges, you should be using Nmap.


Neither netcat, telnet nor nmap are needed. Bash is simpler, portable and more efficient.

Open check

(>/dev/tcp/example.com/80) &>/dev/null && echo "Open" 

Open/Closed Check

(>/dev/tcp/example.com/80) &>/dev/null && echo "Open" || echo "Closed"

Port Range Check

for i in $(seq 80 88); do (>/dev/tcp/example.com/80/$i) &>/dev/null && echo $i Open|| echo $i Closed; done

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.