There are two output modes: text and XML. Text output is the
default, and can also be selected with the --text
option. Text output resembles a unified diff of Nmap's normal
terminal output. Each line is preceded by a character indicating
whether and how it changed. - means that the line
was in the first scan but not in the second; +
means it was in the second but not the first. A line that changed is
represented by a - line followed by a
+ line. Lines that did not change are preceded by
a blank space.
Example 16.1
is an example of text output. Here, port 80 on the host
photos-cache-snc1.facebook.com gained a service
version (lighttpd 1.5.0). The host
at 69.63.179.25 changed its reverse DNS name. The host at
69.63.184.145 was completely absent in the first scan but came up in
the second.
Example 16.1. Ndiff text output
-Nmap 4.85BETA3 at 2009-03-15 11:00
+Nmap 4.85BETA4 at 2009-03-18 11:00
photos-cache-snc1.facebook.com (69.63.178.41):
Host is up.
Not shown: 99 filtered ports
PORT STATE SERVICE VERSION
-80/tcp open http
+80/tcp open http lighttpd 1.5.0
-cm.out.snc1.tfbnw.net (69.63.179.25):
+mailout-snc1.facebook.com (69.63.179.25):
Host is up.
Not shown: 100 filtered ports
+69.63.184.145:
+Host is up.
+Not shown: 98 filtered ports
+PORT STATE SERVICE VERSION
+80/tcp open http Apache httpd 1.3.41.fb1
+443/tcp open ssl/http Apache httpd 1.3.41.fb1
XML output, intended to be processed by other programs, is selected
with the --xml option. It is based on Nmap's XML
output, with a few additional elements to indicate differences. The
XML document is enclosed in nmapdiff and
scandiff elements. Host differences are enclosed
in hostdiff tags and port differences are
enclosed in portdiff tags. Inside a
hostdiff or portdiff,
a and b tags show the state of
the host or port in the first scan (a) or the
second scan (b).
Example 16.2
shows the XML diff of the same scans shown above in
Example 16.1.
Notice how port 80 of
photos-cache-snc1.facebook.com is enclosed in
portdiff tags. For 69.63.179.25, the old hostname
is in a tags and the new is in
b. For the new host 69.63.184.145, there is a
b in the hostdiff without a
corresponding a, indicating that there was no
information for the host in the first scan.
Example 16.2. Ndiff XML output
<?xml version="1.0" encoding="UTF-8"?>
<nmapdiff version="1">
<scandiff>
<hostdiff>
<host>
<status state="up"/>
<address addr="69.63.178.41" addrtype="ipv4"/>
<hostnames>
<hostname name="photos-cache-snc1.facebook.com"/>
</hostnames>
<ports>
<extraports count="99" state="filtered"/>
<portdiff>
<port portid="80" protocol="tcp">
<state state="open"/>
<a>
<service name="http"/>
</a>
<b>
<service name="http" product="lighttpd" version="1.5.0"/>
</b>
</port>
</portdiff>
</ports>
</host>
</hostdiff>
<hostdiff>
<host>
<status state="up"/>
<address addr="69.63.179.25" addrtype="ipv4"/>
<hostnames>
<a>
<hostname name="cm.out.snc1.tfbnw.net"/>
</a>
<b>
<hostname name="mailout-snc1.facebook.com"/>
</b>
</hostnames>
<ports>
<extraports count="100" state="filtered"/>
</ports>
</host>
</hostdiff>
<hostdiff>
<b>
<host>
<status state="up"/>
<address addr="69.63.184.145" addrtype="ipv4"/>
<ports>
<extraports count="98" state="filtered"/>
<port portid="80" protocol="tcp">
<state state="open"/>
<service name="http" product="Apache httpd"
version="1.3.41.fb1"/>
</port>
<port portid="443" protocol="tcp">
<state state="open"/>
<service name="http" product="Apache httpd" tunnel="ssl"
version="1.3.41.fb1"/>
</port>
</ports>
</host>
</b>
</hostdiff>
</scandiff>
</nmapdiff>
