Re: Eliminating non-responsive hosts from XML output

[Kris Katterjohn <katterjohn () gmail com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/08/2010 02:22 PM, David Fifield wrote:
> On Mon, Nov 08, 2010 at 08:59:32AM -0600, shorejsi2 () mmm com wrote:
> >  I have noticed that since moving from Nmap 4.xx to 5.xx the XML output 
> > now contains information from every IP address in the scanned range, even 
> > if it is just 'No response'. Is there a way to exclude these 'empty' 
> > entries? On sparse subnets they make the output way bigger than it would 
> > need to be.
>
> I was surprised at this because those entries are only supposed to be
> shown in verbose mode. But I tested it and the verbose mode requirement
> is ignored when only doing host discovery. It's honored when doing
> anything beyond that, such as a port scan. In short,
>
> nmap -sS      doesn't show down hosts
> nmap -sS -v   shows down hosts
> nmap -sn      shows down hosts
> nmap -sn -v   shows down hosts
>
> I can't remember if this is by design or not. I've attached a patch that
> changes the third line of the table to "doesn't show down hosts"; what
> does everyone think?

Like you, I assumed this was the behavior.  I say change it (even if for no
other reason than consistency).

> David Fifield

Cheers,
Kris Katterjohn

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJM2JthAAoJEEQxgFs5kUfu1KQP/1y1jF9upv0InSMLpNULqKje
86D9JIt87dzD2knCuo8t45os2DbhFEk0tEn7iys0qCo3dIwCTVFlAjRw5Iw6+SHh
HislOcRAAAgZWhkur3Z7lKEDyJVPDHbmdJeQ//81RuEATjTKu6CSVYXBMyuE+fdg
yl/mbhSip4M50KcHtyh/rmoXjgbKit+TjQe384NiwEnvgG+NwtYrMjzqctQf/Tgq
9eX/IF2LLjVS2+44K2VAWVWweDUnXtDsrv/CDdHRZuOOkH3y89Q/26oeaDavzq4l
hgGXmtMyoNoUByUkVAPwmU3unpESnngJRDCum3vmJHPb5L2bLFcF+CiIN4+fdMd1
+fiStlNUm4gTyP1DjV9yU5yCjvMPgxMq4a1MbK50UG7KUVN9bLZzE7Ck6EfuBL5w
4PJNCUdLdEL1phmIMpWMHHpplZdEfCTYBHkf0Zvycy/VUwk4FMSiVogtFVhUa1WA
/twpEYTWpyPV8MX99HXHGNRQnsHUoZ0qDdCKJjS08XgxavySeke0zZXypAbQCTFc
EDClj6RrQ7A7RJelniAT2nT5fUVl40bQ73Q7NcIUp0GuYOerdddrS+nVzZ0XQBiE
Oyv0QsjKMHAFK6zG+9pv6+KWWD5XmaffZtiDAhJWVfZhr0UVm8Y17tHjAbWTO1Ae
J3xoUpa3W1DIVSaoCw9K
=+Tuk
-----END PGP SIGNATURE-----
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/