NDIFF(1)

NAME
ndiff - Utility to compare the results of Nmap scans

SYNOPSIS

ndiff [options] {a.xml} {b.xml}

DESCRIPTION

Ndiff is a tool to aid in the comparison of Nmap scans. Specifically, it takes two Nmap XML output files and prints the differences between them: hosts coming up and down, ports becoming open or closed, and things like that.

Ndiff compares two scans at a time. The “before” scan is called the A scan and the “after” scan is the B scan. The letters A and B are used to avoid giving the impression that scans must be given in time order. They do not; it's possible to get a “backward” diff from a newer scan to an older scan.

Ndiff can produce output in human-readable text or machine-readable XML formats. Use the --text and --xml options to control which. Output goes to standard output.

OPTIONS SUMMARY

-h, --help
    Show a help message and exit.

-v, --verbose
    Do not consolidate long port lists into a simple count. When a host is up in the B scan that was not present in the A scan, commonly most of its ports will change from the state "unknown" to "closed" or "filtered". If the port list is very long, it will be consolidated into a line like

        994 tcp ports changed state from unknown to filtered.

    With --verbose, all 994 ports will be listed:

        The following tcp ports changed state from unknown to filtered:
                1,3,4,6,7,9,13,17,19-21,23,24,26,30,32,
        33,37,42,43,49,79,81-85,88-90,99,100,106,109-11
        1,119,125,135,139,143,144,146,161,163,179,199,2

    and so on.

    In XML output, every port is always listed explictly. --verbose has no effect.

--text
    Write output in human-readable text format.

--xml
    Write output in machine-readable text format. For a description of the XML format see the nmap.dtd file in the Ndiff distribution.

Any other arguments are taken to be the names of Nmap XML output files. There must be exactly two. The first one listed is the A scan and the second is the B scan.

BUGS

Report bugs to the nmap-dev mailing list at <nmap-dev@insecure.org>.

HISTORY

Ndiff started as a project by Michael Pattrick during the 2008 Google Summer of Code. Michael designed the program and led the discussion of its output formats. He wrote versions of the program in Perl and C++, but the summer ended shortly after it was decided to rewrite the program in Python for the sake of Windows compatibility. This Python version is written by David Fifield.

AUTHORS

David Fifield <david@bamsoftware.com>

Michael Pattrick <mpattrick@rhinovirus.org>

WEB SITE

http://nmap.org/ndiff/