It is a common desire to run the same scan twice at different times,
or run two slightly different scans at the same time, and see how they
differ. Zenmap provides an interface for comparing scan results,
shown in Figure 12.16. Open the comparison
tool by selecting “Compare Results” from the
“Tools” menu or by using the
“diff”) keyboard shortcut. Zenmap supports comparing two
scan results at a time.
Figure 12.16. Comparison tool
The first step in performing a comparison is selecting two scans
to compare, which are called the
and the “B scan”.
The combo boxes allow you to choose from open scans. Or click the
“Open” buttons to get scan results from a file.
To compare results from the recent scans database, you must first open
those scans using the search interface (see
the section called “Searching Saved Results”).
The order of the two scans matters. Comparison is always done “from”
the A scan “to” the B scan, regardless of the times recorded
in the files. Once the two results have been chosen the comparison
shows a comparison between two scans of several Internet hosts, run a
few days apart.
Figure 12.17. Comparison output
The diff output resembles Nmap's
Each line is preceded by ‘
+’, indicating that some piece of
information was unchanged, removed, or added respectively. Color
coding also indicates differences; red for deletion and green for
The engine underlying Zenmap's comparison function is Ndiff, a
non-graphical tool distributed with Nmap. Ndiff runs on any platform
that Zenmap runs on. If you have installed the
ndiff executable somewhere other than its default
location, you may have to modify the
variable in the
[paths] section of
to point to it.