Using nc (Netcat) as a Port Scanner in Linux

Netcat can also be used as a port scanner by using the -z option and specifying a host and port range instead of a single port. This option checks the ports in range if there is a deamon listening without sending data. The following example will scan the ports 20 through 25 of 192.168.1.10 and list the open ones:

nc -z 192.168.1.10 20-25

To list the closed ports too include the -v option. For example:

nc -vz 192.168.1.10 20-25

Other options that can be used to speed up scanning are -n to prevent DNS lookup and -w 1 to limit the timeout to 1 second.