16

I know how to use nmap to find the list of hosts that are currently online. What I would like to do is get a list of just their IP addresses, now it displays extra information such as

Nmap scan report for 192.168.x.x' and 'Host is up (0.12s latency).

What I would like is to be able to run an nmap command, get a text document of the IP addresses that are currently online.

Is this at all possible?

migrated from serverfault.com Jan 28 '15 at 22:04

This question came from our site for system and network administrators.

30

This is a common one:

nmap -n -sn 192.0.2.0/24 -oG - | awk '/Up$/{print $2}'

Quick rundown of options and commands:

  • -n turns off reverse name resolution, since you just want IP addresses. On a local LAN this is probably the slowest step, too, so you get a good speed boost.
  • -sn means "Don't do a port scan." It's the same as the older, deprecated -sP with the mnemonic "ping scan."
  • -oG - sends "grepable" output to stdout, which gets piped to awk.
  • /Up$/ selects only lines which end with "Up", representing hosts that are online.
  • {print $2} prints the second whitespace-separated field, which is the IP address.
  • Why have the $ after /Up? I found that the command nmap -n -sn 192.0.2.0/24 -oG - | awk '/Up/{print $2}' provides the same results. – Michael Mar 5 at 19:37
  • 1
    @Michael It's just an extra level of safety to ensure we don't print garbage in case something else contains the string "Up". That way it works even if you run it against grepable output in a file from a different type of scan like -sV which can contain unpredictable strings from network service banners. – bonsaiviking Mar 5 at 20:26
2

You could pipe it to awk:

nmap -sP 192.168.1.0/24 | awk '/is up/ {print up}; {gsub (/\(|\)/,""); up = $NF}'
192.168.1.1
192.168.1.10
192.168.1.20
192.168.1.30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy