0

I have network log file like this one:

Nmap scan report for 192.168.1.51
Host is up.
PORT     STATE    SERVICE
80/tcp   open     http
443/tcp  open     https
8080/tcp open     http-proxy
443/tcp  open     https
8080/tcp open     http-proxy
8082/tcp filtered redcap
8083/tcp filtered https-alt

Nmap scan report for 192.168.1.201
Host is up.
PORT     STATE    SERVICE
80/tcp   open   http
443/tcp  filtered https
8281/tcp filtered http-proxy
8080/tcp open     sedan
8801/tcp filtered https-alt

Nmap scan report for 192.168.1.17
Host is up.
PORT     STATE    SERVICE
80/tcp   closed   http
443/tcp  closed https
9081/tcp open      ecan

Nmap scan report for 192.168.1.10
Host is up.
PORT     STATE    SERVICE
80/tcp   closed   ftp
443/tcp  open   https
9081/tcp open      standard

I want to extract the IP addresses and the counts of open ports for every IP address so the result:

192.168.1.10 - 2
192.168.1.201 - 2
192.168.1.51 - 5
192.168.1.17 - 1
  • Just in case you weren't aware, there's (still) an -oG "greppable output" option for nmap. – Jeff Schaller Oct 18 '18 at 13:05
  • @Jeff Schaller what you mean ? please explain? – user315938 Oct 18 '18 at 13:08
  • I've added an answer with details. – Jeff Schaller Oct 18 '18 at 13:14
0

awk solution:

awk 'BEGIN{RS=""; FS="\n"} 
    {split($1,a," "); host[a[5]] = 0; for (i=1; i<=NF; i++) if (match($i,"open") != 0) 
        host[a[5]]++} END{for (each in host) print each " - " host[each]}' file

192.168.1.10 - 2
192.168.1.201 - 2
192.168.1.51 - 5
192.168.1.17 - 1

In this command the record separator RS was set to a blank line “” and the field separator to a newline\n. Next, awk splits the first line of each record and capture the fifth item in the split array which is relevant to the IP address. After then, Awk iterates through the remaining fields NF looking for the string “open” in each field. When open is present then it will count for the relevant IP address in the host array. Finally, awk prints the results.

  • 1
    Thank you ! would you please explain the command so we understand how it works? – user315938 Oct 18 '18 at 13:05
  • @Sam please see my edits and let me know if you have any questions! – user88036 Oct 18 '18 at 13:11
0

Since you appear to have an nmap log file, if you have control over the invocation of nmap, consider the (deprecated) -oG option to create greppable output. For example:

$ nmap -oG /tmp/output.txt localhost
$ awk '/^Host: / && /Ports: / { num=gsub("/open/", ""); print $2, "-", num }' < /tmp/output.txt
127.0.0.1 - 6

This uses awk to parse the greppable output from nmap; the awk script looks for the "Host:" lines that also contain the string "Ports: "; it then counts the number of "/open/" strings and reports that number for each host.

0

I would use below awk instead:

awk 'function output() { print ip, count; count=0 }
     /Nmap/ && count { output() }
     /Nmap/ { ip=$NF }
     /open/ { count++ }
END{ output() }' infile

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy