Can nmap list all hosts on the local network that have both SSH and HTTP open? To do so, I can run something like:

nmap -p22,80 --open

However, this lists hosts that have ANY of the list ports open, whereas I would like hosts that have ALL of the ports open. In addition, the output is quite verbose:

# nmap -p22,80 --open

Starting Nmap 6.47 ( http://nmap.org ) at 2015-12-31 10:14 EST
Nmap scan report for Wireless_Broadband_Router.home (
Host is up (0.0016s latency).
Not shown: 1 closed port
80/tcp open  http

Nmap scan report for new-host-2.home (
Host is up (0.013s latency).
22/tcp open  ssh
80/tcp open  http

Nmap done: 254 IP addresses (7 hosts up) scanned in 3.78 seconds

What I'm looking for is output simply like:

as the above host is the only one with ALL the ports open.

I certainly can post-process the output, but I don't want to rely on the output format of nmap, I'd rather have nmap do it, if there is a way.

  • 2
    If you want to test only one port, 'nmap -p 22 | grep -B3 open' is a easy way. – Luciano Andress Martini Aug 29 '17 at 19:34

There is not a way to do that within Nmap, but your comment about not wanting "to rely on the output format of nmap" lets me point out that Nmap has two stable output formats for machine-readable parsing. The older one is Grepable output (-oG), which works well for processing with perl, awk, and grep, but is missing some of the more advanced output (like NSE script output, port reasons, traceroute, etc.). The more complete format is XML output (-oX), but it may be overkill for your purposes.

You can either save these outputs to files with -oG, -oX, or -oA (both formats plus "normal" text output), or you can send either one straight to stdout: nmap,80 --open -oG - | awk '/22\/open.*80\/open/{print $2}'

  • 1
    That's perfect, just what I was looking for (the -oG -) – Brian Dec 31 '15 at 17:03

Try the following command:

nmap --open -p 22,80 -oG - | grep "/open" | awk '{ print $2 }'

This will scan for your ports in your range and pipe the output in greppable format looking for open ports, then print the IP addresses that fit any of that criteria.

  • Welcome to U&L! Note that the accepted answer from ~3 years ago has a simpler version of this where it uses awk to grep and print. – Jeff Schaller Dec 13 '18 at 1:56
  • 1
    I would argue mine is better since you don't have to add extra data for more ports beyond the port option. His requires you to update your awk with each port as well, which is unnecessarily verbose. – Marshall Hallenbeck Jun 27 '19 at 13:31
  • For the records, note that your solution is incorrect, since what you have proposed will output ips that doesn't have both ports opened (for example, it will output server with only 80 opened and not 22) @MarshallHallenbeck – Rakiah Oct 23 '20 at 14:01

Consider also this awk one-liner:

nmap -Pn -oG -p22,80,443,445 - | awk '/open/{ s = ""; for (i = 5; i <= NF-4; i++) s = s substr($i,1,length($i)-4) "\n"; print $2 " " $3 "\n" s}'

It will print you all the hosts with all specified opened ports like this: (some-domain.com)
  • You must have added -p after testing this. The '-' on the command line belongs right after -oG – Wayne Nov 26 '17 at 10:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.