Home / server / Questions / 788934
Accepted
λ Jonas Gorauskas
Asked: 2016-07-10 11:36:30 +0800 CST

Check if remote host/port is open - Can't use GNU Netcat nor NMap - RHEL 7

  • 772

At work, the infrastructure team is rolling out new VMs with RHEL7 installed as the base OS. This particular image comes with the nmap-ncat version of Netcat and does not have NMap installed. We are precluded from installing anything on the machines.

Previously, we were using the GNU Netcat which have the -z option to scan a remote host/port to check if it was open. Something like this:

nc -z -v -w 3 remote.host.name 1234

How can I achieve the same check with the new ncat which does not have the -z option on a system where I cannot install nmap?

netcat rhel7 nmap

3 Answers

  1. Best Answer

    Bash allows you to connect to TCP and/or UDP ports by redirecting to special files:

    /dev/tcp/host/port If host is a valid hostname or Internet address, and port is an integer port number or service name, Bash attempts to open the corresponding TCP socket.

    /dev/udp/host/port If host is a valid hostname or Internet address, and port is an integer port number or service name, Bash attempts to open the corresponding UDP socket.

    A failure to open or create a file causes the redirection to fail.

    So to test if you can connect to port 80 on www.example.com the following should work:

    echo -n > /dev/tcp/www.example.com/80

    If the port is blocked you either get a "connection refused" message or a timeout.

    • 16

  2. Though Ncat does not yet support -z, you can get the same behavior with shell redirection:

    $ ncat google.com 80 </dev/null >/dev/null && echo "yes"
yes
$ ncat google.com 81 </dev/null >/dev/null && echo "yes"
Ncat: Connection timed out.
$ ncat scanme.nmap.org 1234 </dev/null >/dev/null && echo "yes"
Ncat: Connection refused.

    The connect timeout can be adjusted with the -w option.

    EDIT: Ncat 7.25BETA2 introduced the -z option which works as it does with GNU netcat, but only on single ports. If you need to scan port ranges, you should be using Nmap.

    • 9

  3. Neither netcat, telnet nor nmap are needed. Bash is simpler, portable and more efficient.

    Open check

    (>/dev/tcp/example.com/80) &>/dev/null && echo "Open"

    Open/Closed Check

    (>/dev/tcp/example.com/80) &>/dev/null && echo "Open" || echo "Closed"

    Port Range Check

    for i in $(seq 80 88); do (>/dev/tcp/example.com/80/$i) &>/dev/null && echo $i Open|| echo $i Closed; done
    • 2