Example: Host: 64.13.134.52 (scanme.nmap.org)

The Host field always comes first and is included no matter what Nmap options are chosen. The contents are the IP address (an IPv6 address if -6 was specified), a space, and then the reverse DNS name in parentheses. If no reverse name is available, the parentheses will be empty.

Example: Status: Up

The Status field indicates the whether the target host is Up, Down, or Unknown. List scan (-sL) always categorizes targets as Unknown because it does not perform any tests. Ping scan lists a host as Up if it responds to at least one ping probe, and Down if no responses are received. It used to also report Smurf if ping probes sent to the target resulted in one or more responses from other hosts, but that is no longer done. Example 13.15 demonstrates a ping scan of five random hosts, while Example 13.16 demonstrates a list scan of five hosts.

# nmap -sn -oG - -iR 5
# Nmap 5.35DC18 scan initiated [time] as: nmap -sn -oG - -iR 5
Host: 93.182.218.153 () Status: Up
Host: 154.223.142.85 () Status: Down
Host: 120.128.8.97 ()   Status: Down
Host: 47.159.134.149 () Status: Down
Host: 24.172.4.19 ()    Status: Down
# Nmap done at [time] -- 5 IP addresses (1 host up) scanned in 4.25 seconds

# nmap -sL -oG - -iR 5
# Nmap 5.35DC18 scan initiated [time] as: ./nmap -sL -oG - -iR 5
Host: 91.244.202.129 () Status: Unknown
Host: 216.36.141.91 (cm216036141091.wcgwave.ca) Status: Unknown
Host: 17.130.29.192 ()  Status: Unknown
Host: 45.89.164.99 ()   Status: Unknown
Host: 215.22.1.81 ()    Status: Unknown
# Nmap done at [time] -- 5 IP addresses (0 hosts up) scanned in 13.00 seconds

Example: Ports: 111/open/tcp//rpcbind (rpcbind V2)/(rpcbind:100000*2-2)/2 (rpc #100000)/, 113/closed/tcp//auth///

The Ports field is by far the most complex, as can be seen in Example 13.14, “A typical example of grepable output”. It includes entries for every interesting port (the ones which would be included in the port table in normal Nmap output). The port entries are separated with a comma and a space character. Each port entry consists of seven subfields, separated by a forward slash (/). The subfields are: port number, state, protocol, owner, service, SunRPC info, and version info. Some subfields may be empty, particularly for basic port scans without OS or version detection. The consecutive slashes in Example 13.14, “A typical example of grepable output” reveal empty subfields. In Perl, you might split them up as so:

($port, $state, $protocol, $owner, $service, $rpc_info, $version) = 
        split('/', $ports);

Alternatively, you could grab the information from the command line using commands such as these:

cut -d/ -f<fieldnumbers>
awk -F/ '{print $<fieldnumber>}'

Certain subfields can contain a slash in other output modes. For example, an SSL-enabled web server would show up as ssl/http and the version info might contain strings such as mod_ssl/2.8.12. Since a slash is the subfield delimiter, this would screw up parsing. To avoid this problem, slashes are changed into the pipe character (|) when they would appear anywhere in the Port field.

Parsers should be written to allow more than seven slash-delimited subfields and to simply ignore the extras because future Nmap enhancements may call for new ones. The following list describes each of the seven currently defined Port subfields.

Example: Protocols: 1/open/icmp/, 2/open|filtered/igmp/

The IP protocol scan (-sO) has a Protocols field rather than Ports. Its contents are quite similar to the Ports field, but it has only three subfields rather than seven. They are delimited with slashes, just as with the Ports field. Any slashes that would appear in a subfield are changed into pipes (|), also as done in the Ports field. The subfields are protocol number, state, and protocol name. These correspond to the three fields shown in interactive output for a protocol scan. An example of IP protocol scan grepable output is shown in Example 13.17. The Host line, which would normally be all one line, is here wrapped for readability.

# nmap -v -sO -oG - localhost
# Nmap 5.35DC18 scan initiated [time] as: nmap -v -sO -oG - localhost
# Ports scanned: TCP(0;) UDP(0;) SCTP(0;) PROTOCOLS(256;0-255)
Host: 127.0.0.1 (localhost)     Status: Up
Host: 127.0.0.1 (localhost)     Protocols: 1/open/icmp/, 2/open/igmp/, 4/open|filtered/ip/, 6/open/tcp/, 17/open/udp/, 41/open|filtered/ipv6/, 47/open|filtered/gre/, 50/open|filtered/esp/, 51/open|filtered/ah/, 108/open|filtered/ipcomp/, 132/open/sctp/, 255/open|filtered//       Ignored State: closed (244)
# Nmap done at [time] -- 1 IP address (1 host up) scanned in 2.36 seconds

Example: Ignored State: filtered (1658)

To save space, Nmap may omit ports in one non-open state from the list in the Ports field. Nmap does this in interactive output too. Regular Nmap users are familiar with the lines such as Not shown: 993 closed ports. For grepable mode, that state is given in the Ignored State field. Following the state name is a space, then in parentheses is the number of ports found in that state.

Example: OS: Linux 2.4.0 - 2.5.20

Any perfect OS matches are listed here. If there are multiple matches, they are separated by a pipe character as shown in Example 13.14, “A typical example of grepable output”. Only the free-text descriptions are provided. Grepable mode does not provide the vendor, OS family, and device type classification shown in other output modes.

Example: Seq Index: 3004446

This number is an estimate of the difficulty of performing TCP initial sequence number prediction attacks against the remote host. These are also known as blind spoofing attacks, and they allow an attacker to forge a full TCP connection to a remote host as if it was coming from some other IP address. This can always help an attacker hide his or her tracks, and it can lead to privilege escalation against services such as rlogin that commonly grant extra privileges to trusted IP addresses. The Seq Index value is only available when OS detection (-O) is requested and succeeds in probing for this. It is reported in interactive output when verbosity (-v) is requested. More details on the computation and meaning of this value are provided in Chapter 8, Remote OS Detection.

Example: IP ID Seq: All zeros

This simply describes the remote host's IP ID generation algorithm. It is only available when OS detection (-O) is requested and succeeds in probing for it. Interactive mode reports this as well, and it is discussed in Chapter 8, Remote OS Detection.