nmap/ndiff

Ndiff

Ndiff is a tool to aid in the comparison of Nmap scans. Specifically, it
takes two Nmap XML output files and prints the differences between them:
hosts coming up and down, ports becoming open or closed, service and OS
changes.

To install, run (as root)
	python setup.py install
It's also possible to run the program from within the distribution
without installing it.

Use "ndiff --help" for usage instructions.

Here is a sample of the output:

$ ./ndiff test-scans/random-1.xml test-scans/random-2.xml
-Nmap 4.75 at 2008-09-11 11:39
+Nmap 4.76 at 2008-09-16 13:59

-scnqxez-842.example.com (10.189.71.117):
+10.189.71.117:
 Host appears to be up.
 Not shown: 995 filtered ports
 PORT    STATE  SERVICE  VERSION
 20/tcp  closed ftp-data
 21/tcp  open   ftp      ProFTPD 1.3.1
 80/tcp  open   http     Apache httpd
 443/tcp open   http     Apache httpd
 873/tcp closed rsync

+cuvtdnray-504.example.com (10.214.143.33):
+Host appears to be up.
+Not shown: 999 filtered ports
+PORT     STATE SERVICE       VERSION
+3389/tcp open  microsoft-rdp Microsoft Terminal Service

 10.226.19.80:
 Host appears to be up.
-Not shown: 999 filtered ports
+Not shown: 997 filtered ports
 PORT     STATE    SERVICE VERSION
-21/tcp   filtered
+21/tcp   open     ftp     Netgear broadband router ftpd 1.0
-23/tcp   filtered
+23/tcp   open     telnet  Netgear broadband router admin telnetd
-80/tcp   filtered
+80/tcp   open     http    Embedded Allegro RomPager webserver 4.07 UPnP/1.0 (ZyXEL ZyWALL 2)
-8701/tcp open     unknown
+8701/tcp filtered


Use -v or --verbose to see all hosts and ports, not just those that have
changed.

Ndiff started as a project by Michael Pattrick <mpattrick@rhinovirus.org>
during the 2008 Google Summer of Code. Michael designed the program and
led the discussion of its output formats. He wrote versions of the
program in Perl and C++, but the summer ended shortly after it was
decided to rewrite the program in Python for the sake of Windows
compatibility. This Python version is written by David Fifield
<david@bamsoftware.com>.

Ndiff web site: http://nmap.org/ndiff/