483

In the old days, we used telnet to see if a port on a remote host was open: telnet hostname port would attempt to connect to any port on any host and give you access to the raw TCP stream.

These days, the systems I work on do not have telnet installed (for security reasons), and all outbound connections to all hosts are blocked by default. Over time, it's easy to lose track of which ports are open to which hosts.

Is there another way to test if a port on a remote system is open – using a Linux system with a limited number of packages installed, and telnet is not available?

3
  • Related: check status of one port on remote host at SO
    – kenorb
    Dec 30, 2015 at 14:50
  • I was having this same issue. The answer by @Subhranath Chunder below helped. However, I then found out that installing Telnet was a small matter of running brew install telnet. So I expect Linux users can do the same with yum and apt-get.
    – Mig82
    Sep 26, 2019 at 9:22
  • When "all outbound connections to all hosts are blocked by default" there will be no way to perform such a test - you are offline Nov 27, 2020 at 4:37

16 Answers 16

401

Bash has been able to access TCP and UDP ports for a while. From the man page:

/dev/tcp/host/port
    If host is a valid hostname or Internet address, and port is an integer port number
    or service name, bash attempts to open a TCP connection to the corresponding socket.
/dev/udp/host/port
    If host is a valid hostname or Internet address, and port is an integer port number
    or service name, bash attempts to open a UDP connection to the corresponding socket.

So you could use something like this:

xenon-lornix:~> cat < /dev/tcp/127.0.0.1/22
SSH-2.0-OpenSSH_6.2p2 Debian-6
^C pressed here

Taa Daa!

17
  • 1
    However on ports that were not open it timed out after 22 seconds (tried on Ubuntu 14.04 (Trusty Tahr) for a remote server). Interestingly, the timeout period is much shorter than the one for nc (see thnee's answer). Jul 21, 2015 at 13:00
  • 2
    @lornix, ok, but in this case I have to get the same result with use nc without -z option, but it still does not work: # nc -v -w5 127.0.0.1 18080 Connection to 127.0.0.1 18080 port [tcp/*] succeeded! # cat < /dev/tcp/127.0.0.1/18080 Just hangs without any result. Just want to understand when I can use "/dev/tcp/host/port" option
    – Alexandr
    Jun 14, 2016 at 7:09
  • 6
    @Alexandr... actually, "hangs without any result" is pretty much expected behavior. cat is waiting for input. nc has extra smarts to enable it to sense no-data pending and stops trying. cat isn't quite as smart. Try cat < /dev/tcp/localhost/22, you should get your sshd header. Evidently, your process on port 18080 waits for something to come in, before sending anything. Port 22 (ssh) greets you with it's version and whatnot. Try it out!
    – lornix
    Jun 14, 2016 at 8:44
  • 1
    @lornix, thank you very much for explanation! Now the restriction is clear. I think using nc should be a preferred way to check ports.
    – Alexandr
    Jun 14, 2016 at 14:29
  • 8
    This was incredibly helpful when working with a docker container that had nothing installed. Was able to quickly verify that the container had access to non-containerized DB via DNS. Example: cat < /dev/tcp/hostname/5432 Oct 24, 2018 at 14:09
531

Nice and verbose! From the man pages.
Single port:

nc -zv 127.0.0.1 80

Multiple ports:

nc -zv 127.0.0.1 22 80 8080

Range of ports:

nc -zv 127.0.0.1 20-30
11
  • 7
    This hanged when tried on Ubuntu 14.04 (Trusty Tahr) for a remote server (same LAN) for closed ports (it timed out after 127 seconds) - thus not very suitable in scripts. It did work though for a service that had a port open. Using option "-w2" could be the solution. Jul 21, 2015 at 12:36
  • 8
    Use -u option for UDP ports.
    – Efren
    Sep 21, 2016 at 0:10
  • 9
    On version 6.4 of ncat -z is not recognized. I was able to do without z
    – smishra
    Apr 6, 2017 at 17:18
  • 6
    You can check multiple ranges with: nc -zv 127.0.0.1 22,80,8080,20-30,443-446 (nc Version: 1.107-4).
    – bobbel
    Jul 6, 2017 at 16:55
  • 4
    that's great, but only if nc is actually installed :P the accepted answer via bash works almost everywhere, more GNU/Linux servers have bash than nc
    – Petr
    Jul 26, 2019 at 10:49
127

Netcat is a useful tool:

nc 127.0.0.1 123 &> /dev/null; echo $?

Will output 0 if port 123 is open, and 1 if it's closed.

11
  • 3
    This is a far more elegant and scriptable answer than my own. It is unfortunate for me that the security-conscious sysadmins who withheld telnet also withheld nc (though – strangely – not curl or wget).
    – Steve HHH
    Jul 19, 2013 at 19:51
  • 1
    Yes that is completely arbitrary and silly.
    – thnee
    Jul 19, 2013 at 20:10
  • 3
    Let the FOR statements begin! Jul 19, 2013 at 21:37
  • 2
    This hanged when tried on Ubuntu 14.04 (Trusty Tahr) for a remote server (same LAN) for closed ports (it timed out after about 127 seconds) - thus not very suitable in scripts. It did work though for a service that had a port open, returning 0. Using option "-w2" could be the solution. Jul 21, 2015 at 13:06
  • 1
    I think -G 2 would be more appropriate for TCP timeout
    – A B
    Aug 24, 2015 at 21:45
80

The simplest method, without making use of another tool, such as socat, is as described in @lornix's answer above. This is just to add an actual example of how one would make use of the psuedo-device /dev/tcp/... within Bash if you wanted to, say, test if another server had a given port accessible via the command line.

Examples

Say I have a host on my network named skinner.

$ (echo > /dev/tcp/skinner/22) >/dev/null 2>&1 \
    && echo "It's up" || echo "It's down"
It's up

$ (echo > /dev/tcp/skinner/222) >/dev/null 2>&1 && \
    echo "It's up" || echo "It's down"
It's down

The reason you want to wrap the echo > /dev/... in parentheses like this, (echo > /dev/...) is because if you don't, then with tests of connections that are down, you'll get these types of messages showing up.

$ (echo > /dev/tcp/skinner/223) && echo hi
bash: connect: Connection refused
bash: /dev/tcp/skinner/223: Connection refused

These can't simply be redirected to /dev/null since they're coming from the attempt to write out data to the device /dev/tcp. So we capture all that output within a sub-command, i.e. (...cmds...) and redirect the output of the sub-command.

8
  • 2
    This is excellent. Wish it would get voted up to the top. I only read this far down the page because I accidentally scrolled before closing it.
    – Still.Tony
    Feb 12, 2015 at 13:44
  • @Okuma.Tony - yes that's always an issue with Q's that have many answers 8-). Thanks for the feedback though, it's appreciated.
    – slm
    Feb 12, 2015 at 14:26
  • 1
    I like it. I made a script out of it for my own use!
    – Marinaio
    Nov 9, 2021 at 15:41
  • 1
    Yes, this answer should be on top. Feb 4, 2022 at 22:22
  • Isn't echo -n better to avoid sending the linebreak?
    – mgutt
    Apr 6, 2022 at 10:47
64

I found that curl may get the job done in a similar way to telnet, and curl will even tell you which protocol the listener expects.

Construct an HTTP URI from the hostname and port as the first argument to curl. If curl can connect, it will report a protocol mismatch and exit (if the listener isn't a web service). If curl cannot connect, it will time out.

For example, port 5672 on host 10.0.0.99 is either closed or blocked by a firewall:

$ curl http://10.0.0.99:5672
curl: (7) couldn't connect to host

However, from a different system, port 5672 on host 10.0.0.99 can be reached, and appears to be running an AMQP listener.

$ curl http://10.0.0.99:5672
curl: (56) Failure when receiving data from the peer
AMQP

It's important to distinguish between the different messages: the first failure was because curl could not connect to the port. The second failure is a success test, though curl expected an HTTP listener instead of an AMQP listener.

4
  • 8
    If curl isn't available, wget might be. wget -qS -O- http://ip.add.re.ss:port should effectively do the same thing.
    – user
    Jul 19, 2013 at 17:52
  • 4
    This even works with a hostname, ex. curl myhost:22.
    – 에이바
    Feb 25, 2014 at 16:17
  • This may be incorrect. I am havng a tomcat service running, but getting 404 error. # curl -k 192.168.194.4:6443 <html><head><title>Apache Tomcat/7.0.34 - Error report</title><style><!--H1 --- HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 404 - /</h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u>/</u></p><p><b>description</b> <u>The requested resource is not available.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.34</h3></body></html> Jun 2, 2015 at 6:30
  • See my post with similar approach.
    – kenorb
    Dec 30, 2015 at 14:49
19

Here is one-liner:

</dev/tcp/localhost/11211 && echo Port is open || echo Port is closed

using Bash syntax explained in @lornix answer.

For more info, check: Advanced Bash-Scripting Guide: Chapter 29. /dev and /proc.

2
  • 1
    what is the timeout for closed ports?
    – Tilo
    Dec 12, 2018 at 17:42
  • Is it possible to suppress error messages?
    – mgutt
    Apr 6, 2022 at 10:43
15
[admin@automation-server 1.2.2]# nc -v -z -w2 192.168.193.173 6443
nc: connect to 192.168.193.173 port 6443 (tcp) failed: Connection refused

[admin@automation-server 1.2.2]# nc -v -z -w2 192.168.194.4 6443
Connection to 192.168.194.4 6443 port [tcp/sun-sr-https] succeeded!

Hope it solves your problem :)

2
  • 1
    Yes, this is better - timing out almost immediately for closed ports. Jul 21, 2015 at 12:38
  • 1
    Does this always use TCP or is there a way to get it to check UDP?
    – kmoe
    Jan 2, 2016 at 17:09
14

Combining the answers from @kenorb and @Azukikuru you could test port open/closed/firewalled.

timeout 1 bash -c '</dev/tcp/127.0.0.1/22 && echo Port is open || echo Port is closed' || echo Connection timeout

Another approach with curl for reaching any port

curl telnet://127.0.0.1:22
1
  • 1
    Add -v to curl is better (curl -v telnet://127.0.0.1:22). If the server does not output anything such as web socket. You don't know which is success connection or time out.
    – Ironhide
    May 9, 2022 at 2:21
10

I was struggling for a whole day because none of these answers seemed to work for me. The problem is that the most recent version of nc no longer has the -z flag, whereas direct access via TCP (as according to @lornix and @slm) fails when the host is not reachable. I eventually found this page, where I finally found not one but two working examples:

  1. nc -w1 127.0.0.1 22 </dev/null

    (the -w flag takes care of the timeout, and the </dev/null replaces the -z flag)

  2. timeout 1 bash -c '(echo > /dev/tcp/127.0.0.1/22) >/dev/null 2>&1'

    (the timeout command takes care of the timeout, and the rest is from @slm)

Then, simply use && and/or || (or even $?) to extract the result. Hopefully, somebody will find this information useful.

6

Here's a function that will pick one of the methods depending on what's installed on your system:

# Check_port <address> <port> 
check_port() {
if [ "$(which nc)" != "" ]; then 
    tool=nc
elif [ "$(which curl)" != "" ]; then
     tool=curl
elif [ "$(which telnet)" != "" ]; then
     tool=telnet
elif [ -e /dev/tcp ]; then
      if [ "$(which gtimeout)" != "" ]; then  
       tool=gtimeout
      elif [ "$(which timeout)" != "" ]; then  
       tool=timeout
      else
       tool=devtcp
      fi
fi
echo "Using $tool to test access to $1:$2"
case $tool in
nc) nc -v -G 5 -z -w2 $1 $2 ;;
curl) curl --connect-timeout 10 http://$1:$2 ;;
telnet) telnet $1 $2 ;;
gtimeout)  gtimeout 1 bash -c "</dev/tcp/${1}/${2} && echo Port is open || echo Port is closed" || echo Connection timeout ;;
timeout)  timeout 1 bash -c "</dev/tcp/${1}/${2} && echo Port is open || echo Port is closed" || echo Connection timeout ;;
devtcp)  </dev/tcp/${1}/${2} && echo Port is open || echo Port is closed ;;
*) echo "no tools available to test $1 port $2";;
esac

}
export check_port
2
  • 1
    why would you set tool, only to use it later in the case statement. isn't it simpler to check which tool is available and use it immediately in the if block? Nov 5, 2019 at 15:46
  • Good point -- I threw that together in a hurry -- it does make sense to collapse the code as you suggested. On the other hand, setting tool could be useful if there's a need to do more with it in another part of the code. May 14, 2020 at 15:05
5

If you have curl installed:

curl -v telnet://$host:$port/$path
2
  • 2
    (1) I presume that you mean that the curl -v telnet://, the : and the (final) / are literal, and $host and $port are placeholders for the name/address of the host in question and the port number in question.  What should the user use for $path?  (2) If the port is open, but it is not implementing HTTP, we can expect this command to fail.  So how does one distinguish between a failure because the port isn’t open and a failure because the port isn’t HTTP? … (Cont’d) Oct 14, 2020 at 21:13
  • 1
    (Cont’d) … (3) curl http://host:port has already been given as an answer (which was clear on point #1 and discussed point #2).  Are you saying that curl -v telnet: is superior to curl http:  Why?  (4) And there’s another answer that suggests curl http://host:port, and there’s even another one suggesting curl telnet://host:port.  What does your answer add to those earlier ones? … … … … … … … … … … … … … … … … … … … … … Please do not respond in comments; edit your answer to make it clearer and more complete. Oct 14, 2020 at 21:13
3

It shouldn't be available on your box, but try with nmap.

1
  • 4
    nmap is a good tool, but not available on these systems. Rather than download nmap, compile it, install it to my home directory, then copy it to all the other systems, I was hoping to find a way using existing tools available in most Linux installations.
    – Steve HHH
    Jul 19, 2013 at 17:16
1

for reference, expanding on @peperunas' answer:

the way to use nmap to test, is:

nmap -p 22 127.0.0.1

(example above uses localhost for demonstration purposes)

1

Most Linux systems do come installed with Python3 these days, you can use a script like this:

import socket


def check_conn():
    conn_data = [
        ('xyz.abc.int', '10.20.200.10', 443),
        ('abc.xyz.int', '10.20.200.12', 8080)
    ]

    for name, host, port in conn_data:
        s = socket.socket()
        try:
            s.settimeout(2)
            s.connect((host, port))
        except Exception as e:
            print(f"ERROR → {name} {host}:{port} → {e}")
            s.close()
        else:
            print(f"OK    → {name} {host}:{port}")
            s.close()


if __name__ == '__main__':
    check_conn()

  1. Save the script in a file like conn_test.py
  2. Then run the script like python3 conn_test.py

You can further modify the script to externalize the host/port data.

0

If you've to test more than on system you may use our test tool dda-serverspec (https://github.com/DomainDrivenArchitecture/dda-serverspec-crate) for such tasks. You may define your expectation

{:netcat [{:host "mywebserver.com" :port "443"}
          {:host "telnet mywebserver.com" :port "80"}
          {:host "telnet mywebserver.com" :port "8443"}]}

and test these expectation either against localhost or against remote hosts (connect by ssh). For remote tests you've to define a targets:

{:existing [{:node-name "test-vm1"
             :node-ip "35.157.19.218"}
            {:node-name "test-vm2"
             :node-ip "18.194.113.138"}]
 :provisioning-user {:login "ubuntu"}}

You may run the test with java -jar dda-serverspec.jar --targets targets.edn serverspec.edn

Under the hood we're using netcat as proprosed above ...

0

@justsomeguy nmap accepts a port range, quickly outputting each open port found, with protocol and closed port count! Edit: Adding suggested option "-Pn" gets results where "-p" didn't, BUT it goes beyond the port range specified.

for example:

nmap -p 1-1023 127.0.0.1
Nmap scan report for localhost.localdomain (127.0.0.1)
Host is up (0.0000070s latency).
Not shown: 1011 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
24/tcp  open  priv-mail
25/tcp  open  smtp
80/tcp  open  http
110/tcp open  pop3
143/tcp open  imap
443/tcp open  https
465/tcp open  smtps
587/tcp open  submission
953/tcp open  rndc
993/tcp open  imaps
995/tcp open  pop3s
Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .