netcat · 技术支持

网络工具箱：网络信息、DNS 检测（DoH、DoH3、DoT、DoQ、TCP、UDP）、DNS 查询、Whois、Ping、MTR、端口扫描、端口连接、iPerf3、IP 计算器。

常见问题

为什么 DoT / DoQ 全部显示“不可用”，而 DoH 正常？: DoT 和 DoQ 使用 853 端口，部分网络（公司、校园、公共 Wi-Fi 或运营商）会封锁该端口。这正是本应用要帮你发现的情况。
DoH3 显示“异常：未使用 HTTP/3”是什么意思？: 服务器有应答，但请求回落到了 HTTP/2，通常是当前网络阻断了 UDP 443。
“可用 / 异常 / 不可用”分别代表什么？: 可用：收到有效应答（NOERROR 或 NXDOMAIN）；异常：服务器有应答但返回错误（如 SERVFAIL、REFUSED）、响应被截断或未使用 HTTP/3；不可用：超时、连接失败、TLS/证书错误、HTTP 错误或响应与查询不符。
如何添加自己的服务器？: 在“DNS 检测”页右上角点“+”，粘贴地址即可自动识别，例如 https://dns.example/dns-query、tls://dns.example、quic://dns.example、192.168.1.1 或 sdns:// 开头的 DNS Stamp。
网络信息里「从国内查询」和「从国外查询」的公网 IP 为什么不同？: 两行分别是国内和国外的服务看到的出口地址。访问国内和国外网站走同一个出口时，两者相同；网络或设备按目的地选择出口时（例如有多个出口的企业网络），两者不同。
同一条线路为什么显示两个地址？: 每条线路同时问两家服务。两家看到的出口不同，常见于多条宽带负载均衡的网络，或出口按目的地选择、两家服务被分到了不同的出口。
DNS 查询中的“系统解析器”是什么？: 服务器一栏留空时，查询交给系统解析，结果与手机上其他 App 看到的一致（包括 DNS 描述文件和 VPN 的 DNS 设置）。填写服务器地址则直接向该服务器查询；输入 IP 地址会自动反查 PTR 记录。
Whois 的注册商一跳超时或连接被拒？: 很多注册商已停止提供 43 端口的 whois 服务，注册局返回的信息仍然有效。也可以在 Whois 的选项里关闭“跟随转介”。
MTR 中某一跳 100% 丢包，但后面的节点正常？: 该路由器不回应探测包（或限速），属正常现象，只要后续节点没有丢包就不影响实际通信。
Ping 不通但网页能打开？: 部分服务器屏蔽 ICMP，可以把 Ping 切换到 TCP 模式，测量到指定端口的建连耗时。
端口扫描里的“开放 / 关闭 / 过滤”是什么意思？: 开放：主机完成了 TCP 握手，有服务在监听。关闭：主机回了 RST，端口上没有服务。过滤：超时内没有回应或收到 ICMP 错误，通常是防火墙丢弃了探测包。
iPerf3 需要什么？: 客户端模式需要一台 iperf3 服务端（例如运行 iperf3 -s 的电脑，或另一台开启服务端模式的 netcat），默认端口 5201；服务端同一时间只接受一个测试，提示“服务器忙”时稍后重试。服务端模式下，对端用 iperf3 客户端连接手机显示的地址，测试期间 App 需保持在前台。
应用会修改手机的 DNS 设置吗？: 不会。应用只发送测试查询，不会更改系统设置。

netcat · Support

A network toolkit: Network Info, DNS checks (DoH, DoH3, DoT, DoQ, TCP, UDP), DNS lookups, Whois, Ping, MTR, Port Scan, Port Connect, iPerf3 and IP Calculator.

FAQ

Why are all DoT / DoQ servers “Unavailable” while DoH works?: DoT and DoQ use port 853, which some networks block. Finding this out is exactly what the app is for.
What does “HTTP/3 was not used” mean for DoH3?: The server answered, but the request fell back to HTTP/2, usually because the network blocks UDP port 443.
What do Available / Issues / Unavailable mean?: Available: a valid answer (NOERROR or NXDOMAIN). Issues: the server answered with an error such as SERVFAIL or REFUSED, a truncated response, or without HTTP/3. Unavailable: timeout, connection failure, TLS or certificate error, HTTP error, or a response that does not match the query.
How do I add my own server?: Tap “+” on the DNS Check tab and paste an address such as https://dns.example/dns-query, tls://dns.example, quic://dns.example, 192.168.1.1 or an sdns:// DNS stamp.
Why do the public IPs “Seen from China” and “Seen Outside China” in Network Info differ?: Each row is the exit address seen by services in China or outside China. They are the same when traffic to both leaves through one exit, and differ when the network or the device chooses the exit by destination, as on enterprise networks with more than one exit.
Why does one route show two addresses?: Each route asks two services at once. They saw different exits, which is common on networks that balance several broadband lines, or when the exit is chosen by destination and the two services get different exits.
What is the “system resolver” in DNS Lookup?: With the server field left empty, the query goes through the system resolver, so you see what other apps on the device see, including DNS profiles and VPN DNS settings. Enter a server address to query that server directly. Entering an IP address looks up its PTR record.
The registrar step of a Whois lookup times out or is refused?: Many registrars have shut down their port-43 whois service; the registry’s answer is still valid. You can also turn off “Follow Referrals” in the Whois options.
A hop in MTR shows 100% loss but later hops are fine?: That router does not answer (or rate-limits) the probes. As long as later hops show no loss, traffic is not affected.
Ping fails but websites load?: Some hosts block ICMP. Switch Ping to TCP mode to measure the connection time to a port instead.
What do Open, Closed and Filtered mean in Port Scan?: Open: the host completed the TCP handshake, so a service is listening. Closed: the host answered with a reset; nothing listens on that port. Filtered: no answer within the timeout, or an ICMP error; usually a firewall drops the probes.
What does iPerf3 need?: As a client it needs an iperf3 server, such as a computer running iperf3 -s or another device running netcat in server mode (port 5201 by default). A server runs one test at a time; retry later if it reports that it is busy. In server mode, connect from an iperf3 client to an address shown in the app and keep the app in the foreground during the test.
Does the app change my device’s DNS settings?: No. It only sends test queries and never changes system settings.