Fyodor wrote:
> Actually I am planning XML to be used for a very different purpose than
> HTML.  XML is an alternative to the "machine formatted" output that scales
> better and is easier to interpret.  HTML is going to be a "pretty
> printed" version that you put into reports after you do a security audit
> :).  It will have pretty tables, more descriptive information, etc.
My reasoning for the "if you have XML you don't need HTML" is because
writing sylesheets (incorporating i18n) gives very nice reports.
I could whip one up this weekend if you are interested 
in seeing what I mean.

> > > 2) Is documented -- I admit there is no documentation for -oM, but I would
> > > like future output modes to be documented (at least if they are meant to
> > > be read by p rograms)
> > The principle piece of documentation is the XSchema.
> 
> Is the XScheme an actual document that you can attach?
It will be when I create it ;-).  
Again probably this weekend.

> Thanks for sending this!  I looked at the example you sent.  It looks
> good.  I think I will add a <nmap arguments=""> or maybe it should be
> <nmap scantype="SYN" scannedports="1-1024" scannedprotocol=TCP>?
> 
> Is it common in XML to stick a bunch of info in the tag (like above)? 
> Or would the preferred way be
> <nmap><scantype>SYN</scantype><scannedports>etc. ?
The first form uses attributes and the second elements.
[There have been HUGE discussions on this question of attributes vs. sub
elements]
The general feeling from the old users (i.e. SGML users) is that
attributes are for minor information: sub-types, keys, colors,
references,
info about where the data came from, clues as to how it should be
processed,
...
It really comes down to what level of abstraction is for considering
the document (pretty ambiguous, eh?).

> Also, what if I wanted to allow more than one scantype?  
> Would it be kosher to do <nmap scantype=SYN scantype=UDP
> scantype=RPC scannedprotocol=TCP scannedprotocol=UDP>
The short answer... No.
Attribute names must be unique for an element.
However, what you have is information about how the scan was
performed so that information is a perfect candidate for attributes.

> Or is there a preferred approach?
A mixed approach would probably be best.
<nmap ...>
  <scan type="SYN" protocol="TCP"/>
  <scan type="UDP" protocol="TCP"/>
or
<nmap ...>
  <scan type="SYN"/>
  <scan protocol="TCP"/>
or
<nmap scantype="SYN UDP RPC" scannedprotocol="TCP UDP">

Frankly, I'm not yet sure how these options combine (I've just
started using nmap) so I can't make a very well informed recommendation.
In the first example the presumption is that scanning is done as a pair.
The second presumes that they are independent.
The third is, tried all combinations.

Also, all attributes must be enclosed in quotes, this wasn't a
requirement for SGML so HTML and its ilk don't require them.
The version attribute on the root element's tag is used to select
a particular schema, the more modern way is to use a namespace.
Either way it defines the rules for a valid document.

> Do you know of any XSchema's that are widely considered to be excellent
> designs that I could look at?
Well XSchema hasn't been approved very long but the DTD's for
some of the languages can give insight.

The XHTML1.0 spec is very good
<http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd>
<http://www.w3.org/TR/xhtml1>
DocBook
MathML
<http://www.w3.org/Math>

Some examples of XSchema (under Usage)
<http://www.w3.org/XML/Schema.html>

-- 
Fredrick Paul Eisele
Netarx, Inc.
Phone (248)647-9800 Fax (248)647-9840
30910 Telegraph Road
Bingham Farms, MI 48025
phreed@netarx.com
www.netarx.com