LinuxGuruz
  • Last 5 Forum Topics
    Replies
    Views
    Last post


The Web Only This Site
  • BOOKMARK

  • ADD TO FAVORITES

  • REFERENCES


  • MARC

    Mailing list ARChives
    - Search by -
     Subjects
     Authors
     Bodies





    FOLDOC

    Computing Dictionary




  • Text Link Ads






  • LINUX man pages
  • Linux Man Page Viewer


    The following form allows you to view linux man pages.

    Command:

    ndiff

    
    
    

    SYNOPSIS

           ndiff [options] {a.xml} {b.xml}
    
    
    

    DESCRIPTION

           Ndiff is a tool to aid in the comparison of Nmap scans. It takes two
           Nmap XML output files and prints the differences between them. The
           differences observed are:
    
           ?   Host states (e.g. up to down)
    
           ?   Port states (e.g. open to closed)
    
           ?   Service versions (from -sV)
    
           ?   OS matches (from -O)
    
           ?   Script output
    
           Ndiff, like the standard diff utility, compares two scans at a time.
    
    
    

    OPTIONS SUMMARY

           -h, --help
               Show a help message and exit.
    
           -v, --verbose
               Include all hosts and ports in the output, not only those that have
               changed.
    
           --text
               Write output in human-readable text format.
    
           --xml
               Write output in machine-readable XML format. The document structure
               is defined in the file ndiff.dtd included in the distribution.
    
           Any other arguments are taken to be the names of Nmap XML output files.
           There must be exactly two.
    
    
    

    EXAMPLE

           Let?s use Ndiff to compare the output of two Nmap scans that use
           different options. In the first, we?ll do a fast scan (-F), which scans
           fewer ports for speed. In the second, we?ll scan the larger default set
           of ports, and run an NSE script.
    
               # nmap -F scanme.nmap.org -oX scanme-1.xml
               # nmap --script=html-title scanme.nmap.org -oX scanme-2.xml
               $ ndiff -v scanme-1.xml scanme-2.xml
               -Nmap 4.90RC2 at 2009-07-16 13:29
               +Nmap 4.90RC2 at 2009-07-16 13:33
    
                scanme.nmap.org (64.13.134.52):
    
           from the output that the scan without the -F fast scan option found two
           additional ports: 70 and 31337. The html-title.nse script produced some
           additional output for port 80. From the port counts, we may infer that
           the fast scan scanned 100 ports (95 filtered, 3 open, and 2 closed),
           while the normal scan scanned 1000 (993 filtered, 3 open, and 4
           closed).
    
           The -v (or --verbose) option to Ndiff made it show even the ports that
           didn?t change, like 22 and 25. Without -v, they would not have been
           shown.
    
    
    

    OUTPUT

           There are two output modes: text and XML. Text output is the default,
           and is also selected with the --text option. Text output resembles a
           unified diff of Nmap?s normal terminal output. Each line is preceded by
           a character indicating whether and how it changed.  - means that the
           line was in the first scan but not in the second; + means it was in the
           second but not the first. A line that changed is represented by a -
           line followed by a + line. Lines that did not change are preceded by a
           blank space.
    
           Example 1, "Ndiff text output" is an example of text output. Here, port
           80 on the host photos-cache-snc1.facebook.com gained a service version
           (lighttpd 1.5.0). The host at 69.63.179.25 changed its reverse DNS
           name. The host at 69.63.184.145 was completely absent in the first scan
           but came up in the second.
    
           Example 1. Ndiff text output
    
               -Nmap 4.85BETA3 at 2009-03-15 11:00
               +Nmap 4.85BETA4 at 2009-03-18 11:00
    
                photos-cache-snc1.facebook.com (69.63.178.41):
                Host is up.
                Not shown: 99 filtered ports
                PORT   STATE SERVICE VERSION
               -80/tcp open  http
               +80/tcp open  http    lighttpd 1.5.0
    
               -cm.out.snc1.tfbnw.net (69.63.179.25):
               +mailout-snc1.facebook.com (69.63.179.25):
                Host is up.
                Not shown: 100 filtered ports
    
               +69.63.184.145:
               +Host is up.
               +Not shown: 98 filtered ports
               +PORT    STATE SERVICE  VERSION
               +80/tcp  open  http     Apache httpd 1.3.41.fb1
               +443/tcp open  ssl/http Apache httpd 1.3.41.fb1
    
           corresponding a, indicating that there was no information for the host
           in the first scan.
    
           Example 2. Ndiff XML output
    
               <?xml version="1.0" encoding="UTF-8"?>
               <nmapdiff version="1">
                 <scandiff>
                   <hostdiff>
                     <host>
                       <status state="up"/>
                       <address addr="69.63.178.41" addrtype="ipv4"/>
                       <hostnames>
                         <hostname name="photos-cache-snc1.facebook.com"/>
                       </hostnames>
                       <ports>
                         <extraports count="99" state="filtered"/>
                         <portdiff>
                           <port portid="80" protocol="tcp">
                             <state state="open"/>
                             <a>
                               <service name="http"/>
                             </a>
                             <b>
                               <service name="http" product="lighttpd" version="1.5.0"/>
                             </b>
                           </port>
                         </portdiff>
                       </ports>
                     </host>
                   </hostdiff>
                   <hostdiff>
                     <host>
                       <status state="up"/>
                       <address addr="69.63.179.25" addrtype="ipv4"/>
                       <hostnames>
                         <a>
                           <hostname name="cm.out.snc1.tfbnw.net"/>
                         </a>
                         <b>
                           <hostname name="mailout-snc1.facebook.com"/>
                         </b>
                       </hostnames>
                       <ports>
                         <extraports count="100" state="filtered"/>
                       </ports>
                     </host>
                   </hostdiff>
                   <hostdiff>
                     <b>
                       <host>
    
                     </b>
                   </hostdiff>
                 </scandiff>
               </nmapdiff>
    
    
    

    PERIODIC DIFFS

           Using Nmap, Ndiff, cron, and a shell script, it?s possible to scan a
           network daily and get email reports of the state of the network and
           changes since the previous scan.  Example 3, "Scanning a network
           periodically with Ndiff and cron" shows the script that ties it
           together.
    
           Example 3. Scanning a network periodically with Ndiff and cron
    
               #!/bin/sh
               TARGETS="targets"
               OPTIONS="-v -T4 -F -sV"
               date='date +%F'
               cd /root/scans
               nmap $OPTIONS $TARGETS -oA scan-$date > /dev/null
               if [ -e scan-prev.xml ]; then
                       ndiff scan-prev.xml scan-$date.xml > diff-$date
                       echo "*** NDIFF RESULTS ***"
                       cat diff-$date
                       echo
               fi
               echo "*** NMAP RESULTS ***"
               cat scan-$date.nmap
               ln -sf scan-$date.xml scan-prev.xml
    
           If the script is saved as /root/scan-ndiff.sh, add the following line
           to root?s crontab:
    
               0 12 * * * /root/scan-ndiff.sh
    
    
    

    EXIT CODE

           The exit code indicates whether the scans are equal.
    
           ?   0 means that the scans are the same in all the aspects Ndiff knows
               about.
    
           ?   1 means that the scans differ.
    
           ?   2 indicates a runtime error, such as the failure to open a file.
    
    
    

    BUGS

           Report bugs to the nmap-dev mailing list at nmap-dev@insecure.org.
    
    
    

    HISTORY

    
    

    WEB SITE

           http://nmap.org/ndiff/
    
    
    

    NOTES

            1. released
               http://seclists.org/nmap-hackers/2000/0315.html
    
    
    

    Ndiff 01/26/2010 NDIFF(1)

    
    
  • MORE RESOURCE


  • Linux

    The Distributions





    Linux

    The Software





    Linux

    The News



  • MARKETING






  • Toll Free

webmaster@linuxguruz.com
Copyright © 1999 - 2016 by LinuxGuruz