How can we make use of netcat to determine if a machine is running a web, mail, or ssh server?

Question

Without using the nmap program or ping,

How can we make use of the netcat program (nc) to determine whether a particular machine is running web, mail or ssh services.

Answer 1

It could be something like this :

nc -vz ip.v4.add.ress 80 #Web (Assuming default port)
nc -vz ip.v4.add.ress 22 #SSH (Assuming default port)
nc -vz ip.v4.add.ress 25 #SMTP/POP/IMAP ? (Assuming SMTP default port)

e.g :

nc -vz 10.9.6.100 80
Connection to 10.9.6.100 80 port [tcp/http] succeeded!

nc -vz 10.9.6.100 25
nc: connect to 10.9.6.100 port 25 (tcp) failed: Connection refused

Answer 2

If you want to see what's running, just run this command:

nc -vz [ip_address] 1-20000

That will scan ports 1-20,000 and report what's running on each port. Note: firewalls may block most of these ports, so if you use port-forwarding to access the machine, you would need to port forward everything.

And you can replace 1-20000 with whatever range you want, like 80-100 or 25-80.