# Tailcat — Peer-to-Peer Networking Without a Control Plane

> A lightweight CLI tool from Tailscale that creates direct peer-to-peer connections using WireGuard, without requiring Tailscale coordination servers.

## Install

Save as a script file and run:

# Tailcat — Peer-to-Peer Networking Without a Control Plane

## Quick Use
```bash
# On the sending machine:
tailcat send myfile.txt
# Displays a connection code

# On the receiving machine:
tailcat receive <connection-code>
```

## Introduction
Tailcat is an open-source CLI tool from Tailscale that creates peer-to-peer network connections between two machines without requiring Tailscale accounts or coordination servers. It leverages Tailscale's data plane (built on WireGuard) for encrypted connections while using a lightweight peer discovery mechanism instead of the full control plane. Think of it as netcat over an encrypted tunnel.

## What Tailcat Does
- Establishes encrypted peer-to-peer connections between any two machines
- Transfers files and streams data without a central server
- Performs NAT traversal automatically using DERP relay fallback
- Creates connections using simple shareable codes
- Provides stdin/stdout piping for composing with other CLI tools

## Architecture Overview
Tailcat uses Tailscale's userspace networking stack to create WireGuard tunnels directly between peers. Connection establishment uses a signaling mechanism that exchanges keys and endpoint information. When direct connectivity is possible, traffic flows peer-to-peer. When NAT prevents direct connections, traffic is relayed through Tailscale's DERP servers, still end-to-end encrypted.

## Self-Hosting & Configuration
- Install via Go: go install tailscale.com/cmd/tailcat@latest
- Pre-built binaries are available in the Tailscale GitHub releases
- No account or configuration file is required
- Works behind NATs, firewalls, and most corporate networks
- Self-host DERP relay servers for fully independent operation

## Key Features
- Zero-config encrypted connections between any two machines
- No account signup or server infrastructure required
- Automatic NAT traversal with DERP relay fallback
- Unix-philosophy design with stdin/stdout composability
- WireGuard-grade encryption on every connection

## Comparison with Similar Tools
- **magic-wormhole** — Python-based file transfer; Tailcat uses WireGuard for faster encrypted streams
- **croc** — Relay-based file transfer; Tailcat supports direct peer-to-peer when possible
- **bore** — TCP tunnel tool; Tailcat provides encrypted end-to-end connections without a server
- **netcat** — Unencrypted TCP connections; Tailcat adds encryption and NAT traversal

## FAQ
**Q: Do I need a Tailscale account?**
A: No. Tailcat works independently without any Tailscale account or control plane.

**Q: Is the connection encrypted?**
A: Yes. All traffic uses WireGuard encryption end-to-end.

**Q: What happens when a direct connection is not possible?**
A: Traffic is relayed through DERP servers, still fully encrypted end-to-end.

**Q: Can I pipe data through tailcat?**
A: Yes. Tailcat supports stdin and stdout for composing with other Unix tools.

## Sources
- https://github.com/tailscale/tailcat

---
Source: https://tokrepo.com/en/workflows/asset-8dc01772
Author: Script Depot