Feature request: option to tolerate non-resolvable exclude/excludefile entries

[<michael () zbuffer com>]

I've read the documentation, searched the nmap-dev archive and Google. I don't believe this feature exists. Apologies 
if I've missed something.


Consider the following scenario:
You'd like to identify computers that are not included in a given list of hostnames. For example, finding Windows 
computers in a given target network space that are not part of Active Directory. In this example, you might dump Active 
Directory computer hostnames into a file called domaincomputers.txt and use the -excludefile command to instruct nmap 
to load the file, resolve the contents through DNS, and exclude the result from the scan. You'd end up with a command 
that might look something like:


nmap -p 135-139,3389 -Pn --open --excludefile "domaincomputers.txt" 192.168.1.*


If there is an entry in the excludefile that cannot be resolved by DNS, nmap returns:


     --------------------------
     Starting Nmap 6.40 ( http://nmap.org ) at 2013-11-27 10:47 Central Daylight Time


     Error resolving name "foo": No such host is known.




     QUITTING!
     --------------------------



I understand the reasoning behind this behavior. I think it makes great sense to exit by default when an excludefile 
entry cannot be resolved. This could avoid a very bad day for someone who has a machine that won't tolerate a scan, or 
for a pentester who knows a particular host is very well monitored. In the above scenario however, the list may contain 
computers that are not resolvable, and that's okay for our purposes.


The feature I'm requesting is an additional option that, when specified, causes nmap to note entries that are not 
resolvable, as in the above output, but to continue parsing and resolving the excludefile. While I have used 
--excludefile,  I believe the --exclude option should logically also respond to such a command.


Thanks for nmap, and for your consideration.
_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/