ndiff
1

# ndiff

Utility to compare the results of Nmap scans

          ndiff

            options

            a.xml

            b.xml

## Description

Ndiff is a tool to aid in the comparison of Nmap scans. Specifically, it takes two Nmap XML output files and prints the differences between them: hosts coming up and down, ports becoming open or closed, etc.

Ndiff compares two scans at a time. The before scan is called the A scan and the after scan is the B scan. The letters A and B are used to avoid giving the impression that scans must be given in time order. They do not; it's possible to get a backward diff from a newer scan to an older scan.

Ndiff can produce output in human-readable text or machine-readable XML formats. Use the `--text` and `--xml` options to control which. Output goes to standard output.

## Options Summary

`-h`
`--help`

  Show a help message and exit.

`-v`
`--verbose`

  Do not consolidate long port lists into a simple count. When a host is up in the B scan that was not present in the A scan, commonly most of its ports will change from the state "unknown" to "closed" or "filtered". If the port list is very long, it will be consolidated into a line like

      994 tcp ports changed state from unknown to filtered.

  With `--verbose`, all 994 ports will be listed:

      The following tcp ports changed state from unknown to filtered:
              1,3,4,6,7,9,13,17,19-21,23,24,26,30,32,
      33,37,42,43,49,79,81-85,88-90,99,100,106,109-11
      1,119,125,135,139,143,144,146,161,163,179,199,2

  and so on.

  In XML output, every port is always listed explictly. `--verbose` has no effect.

`--text`

  Write output in human-readable text format.

`--xml`

  Write output in machine-readable text format. For a description of the XML format see the `nmap.dtd` file in the Ndiff distribution.

Any other arguments are taken to be the names of Nmap XML output files. There must be exactly two. The first one listed is the A scan and the second is the B scan.

## Bugs

Report bugs to the nmap-dev mailing list at nmap-dev@insecure.org.

## History

Ndiff started as a project by Michael Pattrick during the 2008 Google Summer of Code. Michael designed the program and led the discussion of its output formats. He wrote versions of the program in Perl and C++, but the summer ended shortly after it was decided to rewrite the program in Python for the sake of Windows (and Zenmap) compatibility. This Python version was written by David Fifield.

## Authors

David Fifield david@bamsoftware.com

Michael Pattrick mpattrick@rhinovirus.org

## Web site