Bad nmap grepable output

Question

if i scan which nmap one target and i use output grepable option (-oG) if have this output

nmap -sS -oG - 192.168.1.1
Status: Up
Host: 192.168.1.1 ()  Ports: 20/closed/tcp//ftp-data///, 21/open/tcp//ftp///, 22/closed/tcp//ssh///, 43/closed/tcp//whois///, 80/open/tcp//http///
# Nmap done at Thu Dec 12 11:32:36 2

As you can see the line who indicate the ports number have no newline. For use grep it's no easy... :)

I'am on debian wheezy, i use bash, how can i correct this?

Thanks

Answer 1

Well, although they call it "grepable" output, it's more meant to be parsed by tools such as awk, sed or Perl.

Alot of useful information is on NMAP website.

The fields are also separated by tab characters, so i'd start with eg. cut -f5 file to get the fields you want and then you can do fine parsing with say awk -F/ '{print $2}'. I'm not sure what part of the output is of interest.

Perl would also work to parse the output as described on their webpage, but that's probably not needed.

Answer 2

There is nothing wrong with that output. Grepable format is designed to have one line per host, so that you can grep for all hosts with a particular port open.

If what you want is a list of only those ports that are open, you can tell Nmap to only print those with the --open option:

sh$ nmap -p 80,22 localhost -oG - -n -Pn --open
# Nmap 6.41SVN scan initiated Thu Dec 12 08:40:03 2013 as: nmap -p 80,22 -oG - -n -Pn --open localhost
Host: 127.0.0.1 ()  Status: Up
Host: 127.0.0.1 ()  Ports: 22/open/tcp//ssh///  Ignored State: closed (1)
# Nmap done at Thu Dec 12 08:40:03 2013 -- 1 IP address (1 host up) scanned in 0.08 seconds