Nmap Development: Re: Mac addr in Windows 4.11 release

[Brandon Enright <bmenrigh () ucsd edu>]

On Thu, 7 Dec 2006 15:45:08 -0800
"Gerry Stange" <gerry.stange () openwaternet com> wrote:
> Hi,
>  
>     I'm in the process of developing some stuff that utilizes the nmap
> XML output.  When I execute 
>     $ nmap -v -oX nmap.xml -p T:1521 192.168.4.11
>  
>     on linux, I only get the IP addr in the XML output file.
>  
> <address addr="192.168.4.11" addrtype="ipv4" />
>
>     On windows I receive 
>  
> <address addr="192.168.4.11" addrtype="ipv4" />
> <address addr="00:13:72:50:B2:F9" addrtype="mac" vendor="Dell" />
>
>     Is there a way I can suppress the mac address output on Windows?
>  
> Thanks...
>  
> Gerry
The results differ between Linux and Windows because you were a normal user
(not root) on Linux but you were an Administrator on Windows.  Nmap has
typically taken the "more information is better" philosophy and because of
that, the XML format is constantly being extended to present any info it
can.

It's probably in your best interest in the long run to program your tool to
only look at the tags you explicitly want and ignore the rest.  That way,
when additions are made to the XML, your tool will handle them by ignoring
them.  For the <address> tag, simply require that it has an "addrtype="
attributed and that it is set to "ipv4".

Brandon

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org