27

I know how to use nmap to find the list of hosts that are currently online. What I would like to do is get a list of just their IP addresses, now it displays extra information such as 

Nmap scan report for 192.168.x.x' and 'Host is up (0.12s latency).

What I would like is to be able to run an nmap command, get a text document of the IP addresses that are currently online.

Is this at all possible?

Improve this question

4 Answers 4

Reset to default
52

This is a common one:

nmap -n -sn 192.0.2.0/24 -oG - | awk '/Up$/{print $2}'

Quick rundown of options and commands:

  • -n turns off reverse name resolution, since you just want IP addresses. On a local LAN this is probably the slowest step, too, so you get a good speed boost.
  • -sn means "Don't do a port scan." It's the same as the older, deprecated -sP with the mnemonic "ping scan."
  • -oG - sends "grepable" output to stdout, which gets piped to awk.
  • /Up$/ selects only lines which end with "Up", representing hosts that are online.
  • {print $2} prints the second whitespace-separated field, which is the IP address.
Improve this answer
2
  • Why have the $ after /Up? I found that the command nmap -n -sn 192.0.2.0/24 -oG - | awk '/Up/{print $2}' provides the same results.
    – Michael
    Commented Mar 5, 2019 at 19:37
  • 2
    @Michael It's just an extra level of safety to ensure we don't print garbage in case something else contains the string "Up". That way it works even if you run it against grepable output in a file from a different type of scan like -sV which can contain unpredictable strings from network service banners.
    – bonsaiviking
    Commented Mar 5, 2019 at 20:26
3

You could pipe it to awk:

nmap -sP 192.168.1.0/24 | awk '/is up/ {print up}; {gsub (/\(|\)/,""); up = $NF}'
192.168.1.1
192.168.1.10
192.168.1.20
192.168.1.30
Improve this answer
1

Besides awk, you can also use combination of grep and cut as follows:

wolf@linux:~$ nmap -sn -oG - 192.168.0.* | grep Up | cut -d ' ' -f 2
192.168.0.7
192.168.0.8
192.168.0.9
wolf@linux:~$
Improve this answer
0

GNU sort version 7 and later, can sort numbers a little more pretty with -V option

nmap -n -sn 192.168.0.0/24 -oG - | awk '/Up$/{print $2}' | sort -V
192.168.0.2
192.168.0.3
192.168.0.21
192.168.0.22
Improve this answer

You must log in to answer this question.