ndiff 1 ndiff Utility to compare the results of Nmap scans ndiff options a.xml b.xml Ndiff is a tool to aid in the comparison of Nmap scans. Specifically, it takes two Nmap XML output files and prints the differences between them: hosts coming up and down, ports becoming open or closed, and things like that. Ndiff compares two scans at a time. The before scan is called the A scan and the after scan is the B scan. The letters A and B are used to avoid giving the impression that scans must be given in time order. They do not; it's possible to get a backward diff from a newer scan to an older scan. Ndiff can produce output in human-readable text or machine-readable XML formats. Use the --text and --xml options to control which. Output goes to standard output. -h --help Show a help message and exit. -v --verbose Do not consolidate long port lists into a simple count. When a host is up in the B scan that was not present in the A scan, commonly most of its ports will change from the state "unknown" to "closed" or "filtered". If the port list is very long, it will be consolidated into a line like 994 tcp ports changed state from unknown to filtered. With --verbose, all 994 ports will be listed: The following tcp ports changed state from unknown to filtered: 1,3,4,6,7,9,13,17,19-21,23,24,26,30,32, 33,37,42,43,49,79,81-85,88-90,99,100,106,109-11 1,119,125,135,139,143,144,146,161,163,179,199,2 and so on. In XML output, every port is always listed explictly. --verbose has no effect. --text Write output in human-readable text format. --xml Write output in machine-readable text format. For a description of the XML format see the nmap.dtd file in the Ndiff distribution. Any other arguments are taken to be the names of Nmap XML output files. There must be exactly two. The first one listed is the A scan and the second is the B scan. Report bugs to the nmap-dev mailing list at nmap-dev@insecure.org. Ndiff started as a project by Michael Pattrick during the 2008 Google Summer of Code. Michael designed the program and led the discussion of its output formats. He wrote versions of the program in Perl and C++, but the summer ended shortly after it was decided to rewrite the program in Python for the sake of Windows compatibility. This Python version is written by David Fifield. David Fifield david@bamsoftware.com Michael Pattrick mpattrick@rhinovirus.org