Tailcat — Peer-to-Peer Networking Without a Control Plane

Introduction

Tailcat is an open-source CLI tool from Tailscale that creates peer-to-peer network connections between two machines without requiring Tailscale accounts or coordination servers. It leverages Tailscale's data plane (built on WireGuard) for encrypted connections while using a lightweight peer discovery mechanism instead of the full control plane. Think of it as netcat over an encrypted tunnel.

What Tailcat Does

• Establishes encrypted peer-to-peer connections between any two machines
• Transfers files and streams data without a central server
• Performs NAT traversal automatically using DERP relay fallback
• Creates connections using simple shareable codes
• Provides stdin/stdout piping for composing with other CLI tools

Architecture Overview

Tailcat uses Tailscale's userspace networking stack to create WireGuard tunnels directly between peers. Connection establishment uses a signaling mechanism that exchanges keys and endpoint information. When direct connectivity is possible, traffic flows peer-to-peer. When NAT prevents direct connections, traffic is relayed through Tailscale's DERP servers, still end-to-end encrypted.

Self-Hosting & Configuration

• Install via Go: go install tailscale.com/cmd/tailcat@latest
• Pre-built binaries are available in the Tailscale GitHub releases
• No account or configuration file is required
• Works behind NATs, firewalls, and most corporate networks
• Self-host DERP relay servers for fully independent operation

Key Features

• Zero-config encrypted connections between any two machines
• No account signup or server infrastructure required
• Automatic NAT traversal with DERP relay fallback
• Unix-philosophy design with stdin/stdout composability
• WireGuard-grade encryption on every connection

Comparison with Similar Tools

• magic-wormhole — Python-based file transfer; Tailcat uses WireGuard for faster encrypted streams
• croc — Relay-based file transfer; Tailcat supports direct peer-to-peer when possible
• bore — TCP tunnel tool; Tailcat provides encrypted end-to-end connections without a server
• netcat — Unencrypted TCP connections; Tailcat adds encryption and NAT traversal

FAQ

Q: Do I need a Tailscale account? A: No. Tailcat works independently without any Tailscale account or control plane.

Q: Is the connection encrypted? A: Yes. All traffic uses WireGuard encryption end-to-end.

Q: What happens when a direct connection is not possible? A: Traffic is relayed through DERP servers, still fully encrypted end-to-end.

Q: Can I pipe data through tailcat? A: Yes. Tailcat supports stdin and stdout for composing with other Unix tools.

Sources

• https://github.com/tailscale/tailcat