I want to use netcat as a proxy to log http requests and responses to files, then tail these to inspect traffic. Think wireshark.

Tried the following where 'fifo' is a named pipe, 'in' and 'out' are files, netcat proxy on port 8080, server on port 8081.

while true; do cat fifo | nc -l -p 8080 | tee -a in | nc localhost 8081 | tee -a out 1>fifo; done


  • Netcat stop responing after first request (while loop ignored?).

  • Netcat fails with msg localhost [] 8081 (tproxy) : Connection refused if server unavailable on 8081. Question: Is it possible to "lazily" connect to 8081 when request is made? I.e. I do not want to have 8081 running when netcat is started.

3 Answers 3


ncat can do this quite easily, using the --sh-exec argument.

The following command will allow you to see both directions of a TCP connection live, and allows multiple connections. The connection to example.com is done once for each connection received on localhost:8080.

ncat -lkv localhost 8080 -c 'tee /dev/stderr | ncat -v example.com 80 | tee /dev/stderr'

Change the two tee commands to tee -a ./file if you wish to log to a file instead of displaying it live. You can also remove the -v to disable verbose output, leaving just the transfered data printed to the terminal.

-k, --keep-open            Accept multiple connections in listen mode
-l, --listen               Bind and listen for incoming connections
-v, --verbose              Set verbosity level (can be used several times)
-c, --sh-exec <command>    Executes the given command via /bin/sh

See ncat --help or man ncat for more details.

  • And this outputs http headers in proxied connections: 'ncat -lvvv --proxy-type http localhost 8888' Feb 3, 2021 at 21:29

Use socat, you don't need the pipes and fifos

  • Works good. Im able to see the response now. But how do I make socat stay alive for subsequent requests? Tried while true; do socat -v tcp-listen:8080,keepalive=1 tcp:localhost:8081; done and socat -v tcp-listen:8080,keepalive=1 tcp:localhost:8081
    – deephacks
    Oct 6, 2012 at 17:40
  • 1
    Try fork as in socat -v tcp-listen:8080,fork tcp:localhost:8081 Oct 7, 2012 at 9:56

I'd use tcpdump (tutorial) for this. I think the command you want would look like this:

sudo tcpdump -i eth0 -s0 -v port 8080
  • 3
    tcpdump only show raw packets which are hard to read. tcpflow does exactly what I want and eliminate the need to proxy request/response. sudo tcpflow -p -i lo -c port 8081
    – deephacks
    Oct 6, 2012 at 21:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.