# tailcat | Tailscale | Knowledge Base | Instagit

like netcat, but over Tailscale's data plane, without Tailscale's control plane

GitHub Stars: 3.5k

Repository: https://github.com/tailscale/tailcat

---

## Articles

### [What Is the Exit-Node Service Type in Tailcat?](/tailscale/tailcat/what-is-tailcat-exit-node-service-type)

Discover the Tailscale exit node service type in Tailcat. Learn how to configure Tailcat to act as a full-mesh exit node and forward inbound connections to your local network.

- Tags: explainer
- Published: 2026-09-08

### [How Tailcat's SFTP File Server Works: Subsystem Architecture and Security Modes](/tailscale/tailcat/how-tailcat-sftp-file-server-works)

Discover how Tailcat's SFTP server uses SSH subsystems for secure file transfers. Explore its subsystem architecture and security modes for flexible access control.

- Tags: internals
- Published: 2026-09-08

### [What Is the Exec Service Type in Tailcat? A Complete Technical Guide](/tailscale/tailcat/what-is-tailcat-exec-service-type)

Learn about Tailcat's exec service type. This guide details how it runs a command for each TCP connection, using the connection as stdin/stdout in an inetd style.

- Tags: deep-dive
- Published: 2026-09-08

### [How to Use Tailcat for Secure Shell (SSH) Access: Two Methods Explained](/tailscale/tailcat/how-to-use-tailcat-for-ssh)

Learn how to use Tailcat for secure SSH access with two methods. Tailcat offers WireGuard-encrypted tunnels, public-key authentication, and bearer tokens without root access.

- Tags: how-to-guide
- Published: 2026-09-08

### [Tailcat Server Mode Service Types: The Complete Guide to Built-in Network Services](/tailscale/tailcat/tailcat-server-mode-service-types)

Discover the six Tailcat server mode service types: all, exit-node, ssh, no-auth-ssh, files, and exec. Learn how to leverage built-in network services on your tailnet.

- Tags: deep-dive
- Published: 2026-09-08

### [Ephemeral vs. Persistent Keys in Tailcat: What's the Difference?](/tailscale/tailcat/tailcat-ephemeral-vs-persistent-keys)

Understand ephemeral vs persistent keys in Tailcat. Learn how each key type manages identities for temporary sessions or across multiple restarts. Get the details now.

- Tags: deep-dive
- Published: 2026-09-08

### [What Happens When NAT Traversal Fails in Tailcat: DERP Relay Fallback Explained](/tailscale/tailcat/what-happens-when-nat-traversal-fails-in-tailcat)

Discover what happens when NAT traversal fails in Tailcat. Learn how DERP relay fallback ensures your encrypted WireGuard tunnel stays connected and get insights into path-detection commands.

- Tags: deep-dive
- Published: 2026-09-08

### [How Tailcat Establishes WireGuard Tunnels: A Deep Dive into the Tailscale Client Integration](/tailscale/tailcat/how-tailcat-establishes-wireguard-tunnels)

Learn how Tailcat establishes WireGuard tunnels by initiating a Tailscale client, managing virtual interfaces, and handling peer configurations for reliable network connections.

- Tags: deep-dive
- Published: 2026-09-08

### [Tailcat Connection Establishment Flow: From Compact Address to WireGuard Tunnel](/tailscale/tailcat/tailcat-connection-establishment-flow)

Explore the Tailcat connection establishment flow. Discover how Tailcat creates secure WireGuard tunnels from compact addresses using DERP for path discovery and a peer-to-peer handshake.

- Tags: internals
- Published: 2026-09-08

### [How gVisor Netstack Powers Tailcat’s Userspace Networking Architecture](/tailscale/tailcat/gvisor-netstack-role-in-tailcat)

Discover how gVisor Netstack empowers Tailcat with kernel-independent, userspace networking over WireGuard tunnels using a pure-Go TCP/IP implementation.

- Tags: architecture
- Published: 2026-09-08

### [How Tailcat Achieves UDP Hole-Punching for NAT Traversal: Inside the Disco Protocol](/tailscale/tailcat/how-tailcat-achieves-udp-hole-punching)

Discover how Tailcat achieves UDP hole-punching for NAT traversal using its disco protocol. Enable direct UDP connectivity between peers with seamless DERP fallback.

- Tags: deep-dive
- Published: 2026-09-08

### [What Is Magicsock and How It Enables Direct P2P Connections in Tailcat](/tailscale/tailcat/what-is-magicsock-in-tailcat)

Discover Magicsock, Tailscale's UDP networking layer. Learn how it enables direct P2P connections in Tailcat for low-latency, encrypted communication without manual port setup.

- Tags: internals
- Published: 2026-09-08

### [How Tailcat's Userspace WireGuard Implementation Works Without Root Access](/tailscale/tailcat/tailcat-userspace-wireguard-without-root)

Discover how Tailcat's userspace WireGuard implementation operates without root access by leveraging pure Go libraries and UDP sockets for encrypted traffic routing.

- Tags: internals
- Published: 2026-09-08

### [What Userspace Components Does Tailcat Use for Its Network Stack?](/tailscale/tailcat/tailcat-userspace-network-stack-components)

Discover Tailcat's userspace network stack. Learn how it combines WireGuard and gVisor for kernel-free encrypted tunnels and standard Go net.Conn interfaces.

- Tags: internals
- Published: 2026-09-08

### [What Is the Role of DERP in Tailcat's Connection Establishment?](/tailscale/tailcat/role-of-derp-in-tailcat)

Discover DERP's role in Tailcat connection establishment. DERP acts as a bootstrap and NAT traversal fallback, enabling WireGuard key exchange for secure peer-to-peer paths.

- Tags: deep-dive
- Published: 2026-09-08

### [What Are the Components of a Tailcat Address? ServerPublic, ServerDiscoPublic, and PresharedKey Explained](/tailscale/tailcat/tailcat-address-components-explained)

Understand tailcat address components like ServerPublic, ServerDiscoPublic, and PresharedKey. Learn how they enable secure tunnel establishment without DNS exposure.

- Tags: api-reference
- Published: 2026-09-08

### [How Is the Tailcat Address Encoded? Inside the tailscale/tailcat Source Code](/tailscale/tailcat/how-tailcat-address-encoded)

Discover how tailcat addresses are encoded. Learn about CBOR serialization, Base64-URL encoding, and the 'tc' prefix directly from the tailscale/tailcat source code.

- Tags: internals
- Published: 2026-09-08

### [What Is a Tailcat Address? Structure, Contents, and Parsing Guide](/tailscale/tailcat/what-is-tailcat-address)

Learn about tailcat addresses, a URL-safe string encoding WireGuard keys and DERP regions for effortless client connections. Understand its structure and contents.

- Tags: api-reference
- Published: 2026-09-08

### [How Tailcat Handles NAT Traversal Without Port Forwarding](/tailscale/tailcat/how-tailcat-handles-nat-traversal)

Tailcat bypasses NAT and firewalls for direct P2P connections. Learn how WireGuard ICE, DERP relays, and DiscoPing achieve NAT traversal without port forwarding.

- Tags: deep-dive
- Published: 2026-09-08

### [How Tailcat Replaces Netcat with Modern Security Features: WireGuard-encrypted Tunnels for the Modern Era](/tailscale/tailcat/how-tailcat-replaces-netcat)

Discover how Tailcat replaces netcat by securing traffic with WireGuard encrypted tunnels offering automatic NAT traversal and zero-trust authentication.

- Tags: deep-dive
- Published: 2026-09-08

### [Tailcat Requirements: Installation Prerequisites and System Compatibility](/tailscale/tailcat/what-are-tailcat-requirements)

Discover Tailcat installation prerequisites and system compatibility. Learn what you need to use Tailcat, including Go toolchain and network access. No root needed.

- Tags: getting-started
- Published: 2026-09-08

### [How Tailcat Enables Peer-to-Peer Networking Without a Control Plane](/tailscale/tailcat/how-tailcat-enables-peer-to-peer-networking-without-control-plane)

Discover how Tailcat achieves peer-to-peer networking without a control plane. It uses DERP relays, Meow Ping, and WireGuard for direct, encrypted connections.

- Tags: internals
- Published: 2026-09-08

### [How to Resolve a Tailcat Address to a Self‑Contained Form: CLI and Go API Guide](/tailscale/tailcat/how-to-resolve-a-tailcat-address-to-a-self-contained-form)

Resolve a tailcat address to its self-contained form using the CLI expand subcommand or Go API ConnInfo.Expand(). Embed full DERP region data easily.

- Tags: how-to-guide
- Published: 2026-09-06

### [How to Publish Tailcat Addresses Using DNS TXT Records: A Complete Guide](/tailscale/tailcat/how-to-publish-tailcat-addresses-using-dns-txt-records)

Learn how to publish Tailcat addresses using DNS TXT records. Connect via human-readable hostnames instead of raw Tailcat addresses with this complete guide.

- Tags: how-to-guide
- Published: 2026-09-06

### [Maximum UDP Payload Size in Tailcat: IPv4 and IPv6 Limits Explained](/tailscale/tailcat/what-is-the-maximum-udp-payload-size-in-tailcat)

Discover Tailcat's maximum UDP payload size for IPv4 and IPv6. Learn about standard Internet protocol limits and optimize your network performance. Get the details now.

- Tags: deep-dive
- Published: 2026-09-06

### [How to Use Tailcat for Basic STDIN/STDOUT Piping Over Tailscale](/tailscale/tailcat/how-to-use-tailcat-for-basic-stdin-stdout-piping)

Learn to use tailcat for basic STDIN/STDOUT piping over Tailscale. Securely stream encrypted data between machines with simple commands. Get started now.

- Tags: how-to-guide
- Published: 2026-09-06

### [How to Configure SSH Authorized Keys for Tailcat: Complete Guide](/tailscale/tailcat/how-to-configure-ssh-authorized-keys-for-tailcat)

Configure SSH authorized keys for Tailcat using the --ssh-authorized-keys flag. Learn to authenticate clients with literal keys, file paths, and GitHub users for secure access.

- Tags: how-to-guide
- Published: 2026-09-06

### [How to Enable Auth-Free SSH with Tailcat: A Complete Guide](/tailscale/tailcat/how-to-enable-auth-free-ssh-with-tailcat)

Learn how to enable auth free SSH with Tailcat. Securely access your devices using Tailcat's encrypted tunnel for client identity instead of passwords or keys. Get the complete guide.

- Tags: how-to-guide
- Published: 2026-09-06

### [How to Allow‑list Specific Clients in Tailcat: A Complete Guide](/tailscale/tailcat/how-to-allowlist-specific-clients-in-tailcat)

Learn to allowlist specific clients in Tailcat using the --allow flag or Server.AddAllowedClient. Restrict tunnel connections by WireGuard public keys for enhanced security.

- Tags: how-to-guide
- Published: 2026-09-06

### [How to Configure Tailcat Server to Listen on Specific UDP Ports](/tailscale/tailcat/how-to-configure-tailcat-server-to-listen-on-specific-udp-ports)

Learn how to configure Tailcat server to listen on specific UDP ports by setting the ServedUDPPorts field before starting your server. Get precise network control.

- Tags: how-to-guide
- Published: 2026-09-06

### [How to Configure Tailcat Server to Listen on Specific TCP Ports](/tailscale/tailcat/how-to-configure-tailcat-server-to-listen-on-specific-tcp-ports)

Learn how to configure tailcat server to listen on specific TCP ports using the --serve flag or positional arguments with tailcat serve for granular control over exposed local ports.

- Tags: how-to-guide
- Published: 2026-09-06

### [What Are Tailcat Pre-Shared Keys? A Deep Dive into PSK Security in tailscale/tailcat](/tailscale/tailcat/what-are-tailcat-pre-shared-keys)

Discover tailcat pre-shared keys, optional 256-bit WireGuard secrets that provide post-quantum confidentiality for your tunnels, securing data even from compromised relays.

- Tags: deep-dive
- Published: 2026-09-06

### [How to Use tailcat with Ephemeral Keys for Stateless WireGuard Sessions](/tailscale/tailcat/how-to-use-tailcat-with-ephemeral-keys)

Learn how to use tailcat with ephemeral keys for stateless WireGuard sessions. Generate new in-memory keys that disappear when the process exits for enhanced security.

- Tags: how-to-guide
- Published: 2026-09-06

### [What Is the gVisor Netstack in Tailcat? A Deep Dive into Userspace TCP/IP Networking](/tailscale/tailcat/what-is-the-gvisor-netstack-in-tailcat)

Understand the gVisor netstack in Tailcat, a userspace TCP/IP implementation for secure kernel-less networking. Learn how it runs networking in Go without root.

- Tags: deep-dive
- Published: 2026-09-06

### [What Is the Role of Magicsock in Tailcat? A Deep Dive into the Core Data-Plane Component](/tailscale/tailcat/what-is-the-role-of-magicsock-in-tailcat)

Explore Magicsock, the core data-plane component in Tailcat. Discover how it enables encrypted, NAT-traversing P2P connectivity for this Tailscale-based netcat alternative.

- Tags: deep-dive
- Published: 2026-09-06

### [How Tailcat Handles NAT Traversal: A Deep Dive into DERP Bootstrapping and UDP Hole-Punching](/tailscale/tailcat/how-does-tailcat-handle-nat-traversal)

Tailcat handles NAT traversal with DERP bootstrapping and UDP hole-punching. Discover how Tailcat ensures reliable connections, even behind firewalls.

- Tags: deep-dive
- Published: 2026-09-06

### [How to Transfer Files Using Tailcat: A Complete Guide to SFTP File Sharing](/tailscale/tailcat/how-to-transfer-files-using-tailcat)

Learn how to transfer files using Tailcat with its built-in SFTP subsystem. This guide covers secure file sharing and setting up access modes for local directories.

- Tags: how-to-guide
- Published: 2026-09-06

### [How to Use Tailcat for SSH Access: Complete Configuration Guide](/tailscale/tailcat/how-to-use-tailcat-for-ssh-access)

Learn how to use Tailcat for secure SSH access with this complete configuration guide. Effortlessly expose an SSH server over a Tailscale tunnel using the serve sub-command.

- Tags: how-to-guide
- Published: 2026-09-06

### [How to Use tailcat for TCP Port Forwarding: A Complete Guide with Examples](/tailscale/tailcat/how-to-use-tailcat-for-tcp-port-forwarding)

Learn how to use tailcat for TCP port forwarding with this complete guide. Easily proxy connections through an encrypted WireGuard tunnel without a central control plane.

- Tags: how-to-guide
- Published: 2026-09-06

### [What Is the Tailcat Address Format? Structure, Encoding, and Parsing Guide](/tailscale/tailcat/what-is-the-tailcat-address-format)

Understand the Tailcat address format, a URL-safe string encoding server connection metadata like public keys and DERP regions using CBOR. Learn its structure and parsing.

- Tags: api-reference
- Published: 2026-09-06

### [How to Connect to a Tailcat Server: 4 Methods Explained](/tailscale/tailcat/how-to-connect-to-a-tailcat-server)

Learn how to connect to a Tailcat server using four methods: CLI, Web UI, SSH, or SOCKS5. Access your server easily and securely.

- Tags: how-to-guide
- Published: 2026-09-06

### [How to Start a Tailcat Server: CLI Configuration and Examples](/tailscale/tailcat/how-to-start-a-tailcat-server)

Learn how to start a Tailcat server using the CLI. Configure ports, services, and directories with simple commands for easy server setup.

- Tags: how-to-guide
- Published: 2026-09-06

### [How to Install Tailcat on Linux, macOS, and Windows](/tailscale/tailcat/how-to-install-tailcat)

Install Tailcat on Linux macOS and Windows easily. This Go-based CLI utility offers Netcat-style networking over Tailscale without requiring an account or privileged changes.

- Tags: getting-started
- Published: 2026-09-06

### [How Tailcat’s `--allow` Flag Controls Server Access Control](/tailscale/tailcat/tailcat-allow-flag-access-control)

Learn how Tailcat's --allow flag controls server access by restricting client identity keys. Understand how to allow all, deny all, or specify public keys for secure connections.

- Tags: how-to-guide
- Published: 2026-08-30

### [Understanding the Tailcat Key Management Model: A Control-Plane-Free Approach](/tailscale/tailcat/tailcat-key-management-model)

Discover the Tailcat key management model's control-plane-free approach. Learn how nodes generate identities and exchange public keys securely using ConnBlob tokens.

- Tags: deep-dive
- Published: 2026-08-30

### [How to Run Your Own Custom DERP Relays with Tailcat](/tailscale/tailcat/tailcat-custom-derp-relays)

Learn how to run your own custom DERP relays with Tailcat. Configure Tailcat to use a custom DERP map URL or embed DERP regions directly in connection tokens for enhanced control.

- Tags: how-to-guide
- Published: 2026-08-30

### [How Tailcat Handles NAT Traversal and Direct Paths: DERP Bootstrap and the Meow Handshake](/tailscale/tailcat/tailcat-nat-traversal-direct-paths)

Tailcat tackles NAT traversal with DERP bootstrap and the Meow handshake. Learn how it establishes peer-to-peer connections and negotiates direct UDP paths.

- Tags: internals
- Published: 2026-08-30

### [How to Publish Tailcat Tokens Using DNS TXT Records: A Complete Guide](/tailscale/tailcat/tailcat-dns-txt-records)

Learn how to publish Tailcat tokens using DNS TXT records with this complete guide. Connect easily using hostnames instead of raw token strings.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Generate a Persistent WireGuard Key for Tailcat](/tailscale/tailcat/tailcat-generate-persistent-key)

Learn how to generate a persistent WireGuard key for Tailcat. Ensure stable network identity by letting Tailcat create the key automatically or generating one manually with wg genkey.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Parse a Tailcat Token and View Its Contents as JSON](/tailscale/tailcat/tailcat-parse-token-json)

Learn how to parse a Tailcat token and decode its CBOR data into human-readable JSON. Use ParseConnBlobRaw or ParseConnBlob for detailed insights.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Use Tailcat as a SOCKS5 Proxy: Complete Setup and Architecture Guide](/tailscale/tailcat/tailcat-socks5-proxy)

Learn how to use Tailcat as a SOCKS5 proxy. This guide covers complete setup and architecture, converting WireGuard to a local SOCKS5 proxy effortlessly.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Test Tailcat Connectivity with `tailcat ping`](/tailscale/tailcat/tailcat-ping-command)

Test Tailcat connectivity using tailcat ping. Send a discovery ping to check round-trip latency and see if your connection is direct or uses a DERP relay.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to SSH to a Tailcat Server Using Its Token](/tailscale/tailcat/tailcat-ssh-to-server)

Effortlessly SSH to a Tailcat server using its token. The Tailcat CLI simplifies connections through WireGuard tunnels for secure, auth-free access. Learn how now.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Run an Auth-Free SSH Server with Tailcat](/tailscale/tailcat/tailcat-auth-free-ssh-server)

Set up an auth-free SSH server with Tailcat. Eliminate password and key management by using Tailscale for secure peer identity. Simplify your SSH access today.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Use `tailcat --serve` for Port Forwarding and Tunnel Services](/tailscale/tailcat/tailcat-serve-ports-command)

Learn how tailcat --serve restricts TCP connections to specified ports or services like SSH and exit-node forwarding. Master port forwarding with this powerful tool.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Connect to a Tailcat Server Using a Token and Port](/tailscale/tailcat/connect-tailcat-server-token-port)

Learn how to connect to a Tailcat server using a ConnBlob token and port. Access specific services on your Tailcat server with this quick guide.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Start a Tailcat Server That Prints Its Connection Token](/tailscale/tailcat/start-tailcat-server-print-token)

Learn how to start a Tailcat server and print its connection token. Get your Tailcat server token easily with our step-by-step guide.

- Tags: how-to-guide
- Published: 2026-08-30

### [Key Types in the Tailcat Go Library: Server, Client, and Connection Primitives](/tailscale/tailcat/tailcat-go-library-key-types)

Explore the Tailcat Go library's key types like Server, Client, and ConnInfo. Understand connection encoding, WireGuard keys, and peer-to-peer networking primitives for your projects.

- Tags: internals
- Published: 2026-08-30

### [How to Use the Tailcat Go Library as a Client](/tailscale/tailcat/tailcat-go-library-client-usage)

Learn how to use the Tailcat Go library as a client to connect to a Tailcat server over a WireGuard tunnel. Discover its lightweight, control-plane-free design.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Use the Tailcat Go Library as a Server: Complete Implementation Guide](/tailscale/tailcat/tailcat-go-library-server-usage)

Implement a Tailscale server using the Tailcat Go library. Create WireGuard tunnels without root privileges. Learn how to set up your server now.

- Tags: how-to-guide
- Published: 2026-08-30

### [What Is the Meow Handshake in Tailcat? A Deep Dive into the WireGuard Bootstrap Protocol](/tailscale/tailcat/tailcat-meow-handshake)

Understand the Meow handshake in Tailcat a WireGuard bootstrap protocol that efficiently exchanges node and disco keys between Tailcat clients and servers for secure peer relationships.

- Tags: deep-dive
- Published: 2026-08-30

### [How to Resolve a Short Tailcat Connection Token to a Self-Contained Token](/tailscale/tailcat/resolve-short-tailcat-token)

Learn to resolve a short Tailcat connection token to a self-contained one using ConnBlob.Resolve. Enable offline connections by embedding relay details directly.

- Tags: how-to-guide
- Published: 2026-08-30

### [Tailcat Connection Token Format: Structure, Encoding, and Parsing](/tailscale/tailcat/tailcat-connection-token-format)

Understand the Tailcat connection token format. Learn its structure, encoding, and how to parse the URL-safe string containing WireGuard keys and DERP relay metadata.

- Tags: api-reference
- Published: 2026-08-30

### [What Is a Tailcat Connection Token (ConnBlob)? Format and Usage Guide](/tailscale/tailcat/what-is-tailcat-connection-token)

Learn what a Tailcat connection token ConnBlob is. This guide explains its format and usage for secure client connections without network discovery.

- Tags: guide
- Published: 2026-08-30

### [How Tailcat Replaces the Tailscale Coordination Server: A Control-Plane-Free Architecture](/tailscale/tailcat/tailcat-replace-coordination-server)

Discover how Tailcat replaces the Tailscale coordination server with a control-plane-free architecture. Learn about its ConnBlob token and DERP relay bootstrapping for seamless WireGuard connections.

- Tags: architecture
- Published: 2026-08-30

### [Core Tailscale Components Reused by Tailcat: Architecture Guide](/tailscale/tailcat/tailcat-reused-tailscale-components)

Explore how Tailcat reuses core Tailscale components like wgengine, disco, netstack, and tailcfg for WireGuard encryption, NAT traversal, and DERP relays without an external control plane.

- Tags: architecture
- Published: 2026-08-30

### [How Tailcat Achieves Control-Plane-Free WireGuard Tunneling](/tailscale/tailcat/how-tailcat-achieves-control-plane-free-wireguard-tunneling)

Discover how Tailcat achieves control-plane-free WireGuard tunneling by embedding WireGuard configuration within an HTTPS handshake CBOR blob. Learn more about this innovative approach.

- Tags: internals
- Published: 2026-08-30

### [Understanding the `--fixed-region` Flag in `tailcat genkey`](/tailscale/tailcat/purpose-of-tailcat-genkey-fixed-region-flag)

Discover how the --fixed-region flag in tailcat genkey binds your server to a specific DERP region across restarts. Learn to embed region identifiers for consistent performance.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Configure a Custom DERP Map URL in Tailcat](/tailscale/tailcat/can-tailcat-use-custom-derp-map-url)

Learn how to configure a custom DERP map URL in Tailcat using the DERPMapURL option or the -derpmap-url CLI flag. Override the default endpoint easily.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Serve SSH Over Tailcat Using a Custom DERP Relay](/tailscale/tailcat/serve-ssh-tailcat-custom-derp-relay)

Serve SSH over Tailcat using a custom DERP relay. Route auth-free SSH through your self-hosted relay for secure and flexible access. Learn how to configure it today.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Use Tailcat with DNS TXT Records for Server Discovery](/tailscale/tailcat/tailcat-dns-txt-record-server-discovery)

Learn how to use Tailcat with DNS TXT records to discover remote servers. Connect via hostname using ConnBlob tokens for easier server access.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Generate Persistent WireGuard Keys for Tailcat](/tailscale/tailcat/how-to-generate-persistent-tailcat-keys)

Learn how to generate persistent WireGuard keys for Tailcat. Discover how Tailcat bundles private keys and DERP region info for reuse, ensuring secure connections.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Run a Minimal Tailcat Client in Go: Complete Setup Guide](/tailscale/tailcat/how-to-run-minimal-tailcat-client-go)

Learn how to run a minimal Tailcat client in Go. This guide covers setting up a client with a connection token, dialing TCP ports, and utilizing net.Conn for encrypted communication.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Run a Minimal Tailcat Server in Go](/tailscale/tailcat/how-to-run-minimal-tailcat-server-go)

Easily run a minimal Tailcat server in Go. Set up a WireGuard tunnel and DERP connection quickly. Share tokens for secure, encrypted client connections.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Explicitly Perform the Meow Handshake with Tailcat](/tailscale/tailcat/how-to-perform-tailcat-meow-handshake-explicitly)

Explicitly perform the Meow handshake in Tailcat. Learn how to construct a Meow Ping packet, send it via MagicSock, and register your node as a WireGuard peer.

- Tags: how-to-guide
- Published: 2026-08-30

### [How to Establish a Tailcat Tunnel Lazily: Automatic Server Startup Guide](/tailscale/tailcat/how-to-establish-tailcat-tunnel-lazily)

Learn how to establish a Tailcat tunnel lazily. Tailcat automatically starts its background server on first Client.Dial invocation, simplifying setup and eliminating manual initialization.

- Tags: how-to-guide
- Published: 2026-08-30

### [How a Tailcat Client Connects to a Server: WireGuard Tunnel Establishment](/tailscale/tailcat/how-tailcat-client-connects-to-server)

Learn how a Tailcat client establishes a secure WireGuard tunnel to a server. Explore ConnBlob tokens, DERP relays, and the handshake process for seamless P2P connections.

- Tags: internals
- Published: 2026-08-30

### [Configuration Options for a Tailcat Server: Complete Guide](/tailscale/tailcat/tailcat-server-configuration-options)

Master Tailcat server configuration with this guide. Explore programmatic and command-line options for keys, DERP regions, access control, and traffic. Optimize your server setup.

- Tags: how-to-guide
- Published: 2026-08-30

### [How a Tailcat Server Manages Incoming WireGuard Clients: Deep Dive into User-Space Relay Authentication](/tailscale/tailcat/tailcat-server-manage-incoming-clients)

Discover how a Tailcat server manages incoming WireGuard clients using CBOR tokens and public key validation. Understand the authentication process for secure tunnel establishment.

- Tags: deep-dive
- Published: 2026-08-30

### [How the Tailcat Meow Discovery Handshake Works: A Deep Dive into WireGuard Bootstrapping](/tailscale/tailcat/tailcat-meow-discovery-handshake-flow)

Understand the Tailcat Meow discovery handshake, a two-packet protocol bootstrapping WireGuard tunnels by exchanging public keys over raw DERP packets for peer registration and verification.

- Tags: deep-dive
- Published: 2026-08-30

### [What Is the Meow Protocol in Tailcat? Complete Technical Guide](/tailscale/tailcat/what-is-tailcat-meow-protocol)

Discover the Meow protocol in Tailcat. Learn how this bootstrap mechanism establishes WireGuard peer relationships over DERP connections using a unique magic prefix and ping-pong messages.

- Tags: deep-dive
- Published: 2026-08-30

### [What Information Is Contained in a Tailcat ConnBlob?](/tailscale/tailcat/tailcat-connblob-contents)

Discover what information is in a Tailcat ConnBlob. This URL-safe string contains server public key and DERP region for client authentication and connection without extra network calls.

- Tags: deep-dive
- Published: 2026-08-30

### [How Is a Tailcat Connection Token Encoded? The ConnBlob Format Explained](/tailscale/tailcat/how-is-tailcat-connection-token-encoded)

Discover how Tailcat connection tokens are encoded. Learn about the ConnBlob format, CBOR serialization, and base64-URL encoding used to create compact, URL-safe strings for Tailscale.

- Tags: internals
- Published: 2026-08-30

### [What Is a Tailcat Connection Token (ConnBlob)? A Complete Technical Guide](/tailscale/tailcat/what-is-tailcat-connection-token-connblob)

Discover what a Tailcat connection token ConnBlob is. Learn how this string enables secure client connections without DNS lookups in our complete technical guide.

- Tags: deep-dive
- Published: 2026-08-30

### [How Tailcat Uses Netstack (gVisor) to Enable Inbound Connections](/tailscale/tailcat/tailcat-netstack-gvisor-inbound-connections)

Discover how Tailcat uses Netstack (gVisor) to enable inbound connections by embedding a full TCP/IP stack that routes encrypted packets to user callbacks.

- Tags: internals
- Published: 2026-08-30

### [What Is the Role of Magicsock in Tailcat? A Deep Dive into the Data Plane](/tailscale/tailcat/role-of-magicsock-in-tailcat)

Discover magicsock's crucial role in Tailcat. Understand how it handles NAT traversal and multiplexes traffic over UDP or DERP relays, independent of the control plane.

- Tags: deep-dive
- Published: 2026-08-30

### [How Tailcat Handles NAT Traversal: DERP Relays, Magicsock, and Direct WireGuard Upgrades](/tailscale/tailcat/tailcat-nat-traversal-mechanisms)

Learn how Tailcat handles NAT traversal using DERP relays magicsock and direct WireGuard upgrades Discover the technology behind seamless P2P connections.

- Tags: deep-dive
- Published: 2026-08-30

### [Does Tailcat Require Root Access? Technical Guide to Userspace Networking](/tailscale/tailcat/does-tailcat-require-root-access)

Discover if Tailcat needs root access. Learn how this userspace networking tool leverages Tailscale and gVisor for secure, privileged-free operation. Get the technical guide here.

- Tags: technical-guide
- Published: 2026-08-30

### [Core Components of Tailcat's Architecture: How the P2P Tunneling Tool Works](/tailscale/tailcat/tailcat-architecture-components)

Explore Tailcat's architecture. Discover its control-plane-free P2P tunneling, leveraging Tailscale's data plane for direct, secure connections without accounts or daemons.

- Tags: architecture
- Published: 2026-08-30

### [How to Set Up a Tailcat Server Without a Tailscale Account](/tailscale/tailcat/how-to-set-up-tailcat-server-without-tailscale-account)

Set up a Tailcat server without a Tailscale account. This guide shows how to use the single binary for account-free, root-free, and config-free networking with a self-generated token.

- Tags: how-to-guide
- Published: 2026-08-30