socat

What it does

socat creates a bidirectional data channel between two endpoints (“addresses”), such as TCP/UDP sockets, Unix domain sockets, files, pipes, or serial ports. It’s often used as a smarter netcat with support for TLS and many transport types.

How it works (mechanical)

You provide two addresses. socat opens each endpoint and shuttles bytes between them. Options can modify behavior (forking, reuse, timeouts) and can wrap endpoints (TLS, proxy, PTY).

• Address pairs: TCP-LISTEN, TCP, UDP, UNIX-LISTEN, UNIX-CONNECT, FILE, PTY, etc.
• Forking servers: fork to handle multiple clients
• Security: OPENSSL-LISTEN / OPENSSL for TLS
• Transparency: can proxy raw streams without protocol awareness

10 Practical Examples

# 1) Simple TCP listener that prints incoming data
sudo socat - TCP-LISTEN:8080,reuseaddr

# 2) Forward local port 8080 to remote host:80 (basic TCP proxy)
sudo socat TCP-LISTEN:8080,reuseaddr,fork TCP:example.com:80

# 3) Connect to a TCP service (netcat-like client)
socat - TCP:127.0.0.1:8080

# 4) UDP listener (useful for quick syslog/tests)
sudo socat - UDP-LISTEN:514,reuseaddr

# 5) Forward UDP port 9999 to another host/port
sudo socat UDP-LISTEN:9999,reuseaddr,fork UDP:192.168.1.50:9999

# 6) Bridge a Unix domain socket to TCP (common for local daemons)
sudo socat TCP-LISTEN:9000,reuseaddr,fork UNIX-CONNECT:/var/run/my.sock

# 7) Create a PTY pair (handy for serial/TTY testing)
socat -d -d PTY,raw,echo=0 PTY,raw,echo=0

# 8) Quick “file sink” (append everything received to a file)
sudo socat -u TCP-LISTEN:7000,reuseaddr,fork OPEN:/tmp/incoming.log,creat,append

# 9) TLS server (self-signed cert) that forwards to local plaintext service
# Generate key+cert first, then:
sudo socat OPENSSL-LISTEN:8443,reuseaddr,fork,cert=server.crt,key=server.key TCP:127.0.0.1:8080

# 10) TLS client to a server (debug connectivity)
socat - OPENSSL:example.com:443,verify=0

Notes & Gotchas

• fork is essential for servers that should accept multiple clients.
• Use reuseaddr on listeners to avoid “Address already in use” after restarts.
• Be careful exposing listeners to the world — socat is a raw relay and can become an unintended open proxy.
• TLS options vary; test with -d -d for verbose diagnostics.
• For long-running services, consider systemd units and explicit firewall rules.

Historical Context

socat (“SOcket CAT”) evolved from the need for a more capable netcat-like tool, supporting many endpoint types (not just TCP) and adding features like TLS and PTYs.

Modern Equivalent / Related Tools

• nc / ncat — simple TCP/UDP clients and listeners
• ssh -L / -R — encrypted port forwarding
• stunnel — TLS wrapping for legacy services
• haproxy / nginx — robust TCP/HTTP proxying
• openssl s_client — TLS debugging