How to Use netcat (nc) on a Mac to Test Ports

Every Mac already has nc — netcat — so there is nothing to install to check whether a port is open, scan a short range, or stand up a throwaway listener to test a connection. The catch is that macOS ships Apple’s BSD netcat, not the GNU version most Linux tutorials are written against, so a few flags you copy from the internet will not exist. Here is what works on a Mac, verified on macOS 26.5.2.

Test whether a port is open

This is the one people come for. -z means “scan without sending data” (just check the connection), and -v makes it say what happened. An open port and a closed port look like this:

$ nc -zv localhost 22
Connection to localhost port 22 [tcp/ssh] succeeded!

$ nc -zv localhost 9
nc: connectx to localhost port 9 (tcp) failed: Connection refused
nc: connectx to localhost port 9 (tcp) failed: Connection refused

Two macOS details to notice. The word is connectx, not connect — that is Apple’s own connection call, and it is why searching the error text against Linux answers can come up empty. And the failure prints twice because the name resolves to both an IPv6 and an IPv4 address, and nc tries each. On a remote host you would swap localhost for a hostname or IP, for example nc -zv 192.0.2.10 443.

Scan a range of ports

Give a range with a hyphen and nc walks every port, reporting only what it finds. This is handy for “is anything listening between 8000 and 8010” without installing a scanner:

$ nc -zv localhost 20-25
nc: connectx to localhost port 20 (tcp) failed: Connection refused
nc: connectx to localhost port 21 (tcp) failed: Connection refused
Connection to localhost port 22 [tcp/ssh] succeeded!
nc: connectx to localhost port 23 (tcp) failed: Connection refused
nc: connectx to localhost port 24 (tcp) failed: Connection refused
nc: connectx to localhost port 25 (tcp) failed: Connection refused

To keep only the hits, filter for the success line: nc -zv localhost 20-25 2>&1 | grep succeeded. The messages come on standard error, which is why the redirect is needed to catch them.

Stand up a throwaway listener

-l puts nc in listen mode, which turns it into a one-off server — useful for confirming that traffic actually reaches a port, or moving a bit of text between two machines without setting anything up. In one terminal, listen and write what arrives to a file:

$ nc -l 9998 > got.txt

In another, connect and send a line:

$ echo "hello from osxhub" | nc -w2 localhost 9998

$ cat got.txt
hello from osxhub

The text made the round trip. Point the sending side at another machine’s IP instead of localhost and you have an ad-hoc way to shove a file or a message across a local network. The listener handles one connection and exits, which is exactly what you want for a quick test.

Timeouts and UDP

By default a connection attempt to a dead host can hang. -G caps the connection phase in seconds and -w caps the whole exchange, so a probe fails fast instead of stalling a script:

$ nc -z -G2 -w2 -v example.net 443

netcat is TCP unless you tell it otherwise. Add -u for UDP — useful for poking at DNS on 53 or other UDP services — and force an address family with -4 or -6 when a host answers on both and you only care about one. That last one also sidesteps the doubled error lines from the port test above.

Where BSD netcat differs from Linux

The netcat on a Mac is Apple’s BSD build, and copied-from-Linux commands fail in small ways because of it. The GNU netcat’s -N (close the connection on end-of-file) does not exist here, and neither does its -q; the connection-close behavior is handled differently. In exchange, the Mac build carries Apple-only options such as --apple-no-cellular that the Linux one never had.

The practical takeaway: if a netcat command from a tutorial errors with an unknown-flag message, it is almost certainly written for GNU netcat. Check nc -h for the flag your Mac actually supports rather than assuming the tutorial is wrong. For a persistent listener or scripted transfers that need GNU behavior, Homebrew can install an alternative netcat build alongside the system one — but for a quick port check, the built-in nc is already enough.

Flag quick reference

Goal	Command
Test one port	nc -zv host 443
Scan a range	nc -zv host 8000-8010
Keep only open ports	nc -zv host 8000-8010 2>&1 | grep succeeded
Listen on a port	nc -l 9998
Send a line to a listener	echo "hi" | nc host 9998
Fail fast with a timeout	nc -z -G2 -w2 host 443
Use UDP instead of TCP	nc -zu host 53

That is netcat for everyday use on a Mac: -zv to check a port, a range when you are not sure which one, -l to listen, and a timeout so nothing hangs. It is already installed, and for most connectivity checks it is faster than reaching for anything bigger.