Periodic Diffs

Using Nmap, Ndiff, cron, and a shell script, it's possible to scan a network daily and get email reports of the state of the network and changes since the previous scan. Example 16.3 shows the script that ties it together.

Example 16.3. Scanning a network periodically with Ndiff and cron

#!/bin/sh
TARGETS="<targets>"
OPTIONS="-v -T4 -F -sV"
date=`date +%F`
cd /root/scans
nmap $OPTIONS $TARGETS -oA scan-$date > /dev/null
if [ -e scan-prev.xml ]; then
        ndiff scan-prev.xml scan-$date.xml > diff-$date
        echo "*** NDIFF RESULTS ***"
        cat diff-$date
        echo
fi
echo "*** NMAP RESULTS ***"
cat scan-$date.nmap
ln -sf scan-$date.xml scan-prev.xml

If the script is saved as /root/scan-ndiff.sh, add the following line to root's crontab:

0 12 * * * /root/scan-ndiff.sh