Tailcat: netcat Without the Network Plumbing

Tailscale shipped a netcat over its data plane. Instant TCP pipes between machines — no open ports, no certs, no IP archaeology.

Dafallah Ibrahim

— 2 min read
Share

Half the time "is the service down?" is really "can I even reach that port?" netcat answers that question — when the network cooperates. Security groups, NAT, private subnets, and one VPN config nobody understands usually don't.

Tailscale just shipped tailcat: netcat's verbs, running over Tailscale's data plane. If both machines are on your tailnet, the path already exists. It's on Hacker News's front page today, and it's the kind of small tool that quietly replaces a pile of ugly workarounds.

Why this matters

Ad-hoc connectivity debugging eats real time. You SSH into the box, run nc from localhost, confirm the app listens — then fight the actual network path separately. tailcat collapses that into one step: test the path from your laptop, through the tailnet, straight to the port.

Identity comes along for free. A tailnet connection is authenticated with WireGuard keys and gated by your ACLs, so a quick debug pipe needs no password, no token, and no TLS cert you generated in a hurry.

How it works

Tailscale splits control plane from data plane. The coordination server hands out keys and the node map; actual traffic flows peer-to-peer over WireGuard, with DERP relays as fallback when NAT is hostile.

netcat's job is a raw socket: listen or connect, shovel bytes. tailcat keeps those verbs but swaps the transport. Names resolve through MagicDNS, encryption comes from WireGuard itself, and who may connect is decided by tailnet policy — not by which ports you happened to leave open.

Where this helps

  • Port checks from your actual laptop. Confirm the service listens without SSHing in — proving it on localhost proves nothing about the real path.
  • One-off file moves. Pipe a tarball to your laptop in a single command. No scp setup, no transfer tooling on locked-down hosts.
  • Raw HTTP smoke tests. Send a handcrafted GET at an internal service and read the reply — the classic netcat party trick, now without a jump host.
  • Locked-down clouds. Hosts with no inbound rules beyond SSH. If they're on the tailnet, they're reachable.

Watch out

  • Both endpoints must be on the tailnet, and ACLs still apply. tailcat can't override policy — that's the point.
  • Services bound only to 127.0.0.1 stay invisible. Something has to listen on an interface the tailnet can reach.
  • Traffic is peer-to-peer when possible, but relays through DERP when NAT blocks direct connections. Big transfers may crawl.
  • It's a debugging tool, not infrastructure. For anything permanent, expose the service properly instead of babysitting an nc session.

Try it yourself

The netcat verbs carry over. Listen on one machine, connect from the other:

# Laptop: listen on 9000 and capture whatever arrives
tailcat -l 9000 > logs.tar.gz

# Server (anywhere on your tailnet): ship the logs over
tar czf - /var/log/app | tailcat my-laptop:9000

TL;DR

  • What changed: Tailscale released tailcat — netcat-style listen and connect over the tailnet data plane.
  • Why it matters: ad-hoc port tests and one-off pipes between machines, with no open ports, no certs, no IP plumbing.
  • Try today: replace your next "SSH in and run nc" detour with a direct tailcat connection.

Read more