Ncat/EOF behavior

From SecWiki
Jump to: navigation, search

This page describes how Ncat handles End Of File when reading from various places. We wish to be consistent internally and to be consistent with Traditional and OpenBSD netcats when they agree with each other.

Behavior

Client/Connect Mode (TCP)

EOF on: stdin socket
no options closes socket write[1], keeps running closes stdout, keeps running[2]
--send-only quits N/A, does not read from socket
--recv-only N/A, does not read from stdin quits

Server/Listen mode (TCP)

EOF on: stdin socket
no options closes socket write[1], keeps running closes stdout, quits [3]
--send-only quits N/A, does not read from socket
--recv-only N/A, does not read from stdin quits

Other considerations

--no-shutdown

Ncat supports the TCP idea of half-open connections. When EOF is read on stdin, Ncat calls shutdown on the socket in the "write" direction. The --no-shutdown option can be used to prevent this behavior, and may be necessary in some circumstances in order to prevent Ncat from closing entirely while there is still data to be received.

--keep-open

The --keep-open or -k option can be used in server mode to run a simple forking network server. In this case, the tables above may not describe the behavior of the forked processes.

References

  1. 1.0 1.1 If --no-shutdown is used, the socket will remain open.
  2. Traditional/OpenBSD netcats do not keep running. We may want to change this. http://seclists.org/nmap-dev/2017/q2/94
  3. This is the wrong behavior: http://seclists.org/nmap-dev/2013/q1/227