Like any proper pipeline utility, Ncat reads from standard input and writes to standard output so you can redirect I/O to or from any program or file. The only exception is when Ncat is run with the --exec or --sh-exec options, in which case it communicates with the subprocess instead. Nothing in the streams is added, removed, or altered, unless you specifically ask for it with an option such as -C (CRLF processing) or --telnet (Telnet negotiation). If Ncat prints any diagnostic messages, they are sent to standard error so as not to interfere with the data stream. By default Ncat does not print any such messages, but you can enable them with the --verbose (-v) option. Use -v more than once for even more output.

Use the --output option or its alias -o to record a transcript of everything sent and received to a file:

The log contains everything sent and received without differentiation. Sometimes a hex dump is more useful than a plain text log; for that use --hex-dump or -x. Let's see what happens if we accidentally speak SMTP to an SSH server:

$ ncat -C --hex-dump ssh-hex.log scanme.nmap.org 22
SSH-2.0-OpenSSH_4.3
HELO example.com
Protocol mismatch.

The --hex-dump log file for this session:

[0000]   53 53 48 2D 32 2E 30 2D   4F 70 65 6E 53 53 48 5F   SSH-2.0- OpenSSH_
[0010]   34 2E 33 0A                                         4.3.
[0000]   48 45 4C 4F 20 65 78 61   6D 70 6C 65 2E 63 6F 6D   HELO exa mple.com
[0010]   0D 0A                                               ..
[0000]   50 72 6F 74 6F 63 6F 6C   20 6D 69 73 6D 61 74 63   Protocol  mismatc
[0010]   68 2E 0A                                            h..

Each transmission is dumped separately. There is a break and the counter at the left starts over each time there is a new send.