ndiff(1) — Linux manual page


NDIFF(1)                      User Commands                     NDIFF(1)

NAME         top

       ndiff - Utility to compare the results of Nmap scans

SYNOPSIS         top

       ndiff [options] {a.xml} {b.xml}

DESCRIPTION         top

       Ndiff is a tool to aid in the comparison of Nmap scans. It takes
       two Nmap XML output files and prints the differences between
       them. The differences observed are:

       •   Host states (e.g. up to down)

       •   Port states (e.g. open to closed)

       •   Service versions (from -sV)

       •   OS matches (from -O)

       •   Script output

       Ndiff, like the standard diff utility, compares two scans at a


       -h, --help
           Show a help message and exit.

       -v, --verbose
           Include all hosts and ports in the output, not only those
           that have changed.

           Write output in human-readable text format.

           Write output in machine-readable XML format. The document
           structure is defined in the file ndiff.dtd included in the

       Any other arguments are taken to be the names of Nmap XML output
       files. There must be exactly two.

EXAMPLE         top

       Let's use Ndiff to compare the output of two Nmap scans that use
       different options. In the first, we'll do a fast scan (-F), which
       scans fewer ports for speed. In the second, we'll scan the larger
       default set of ports, and run an NSE script.

           # nmap -F scanme.nmap.org -oX scanme-1.xml
           # nmap --script=html-title scanme.nmap.org -oX scanme-2.xml
           $ ndiff -v scanme-1.xml scanme-2.xml
           -Nmap 5.35DC1 at 2010-07-16 12:09
           +Nmap 5.35DC1 at 2010-07-16 12:13

            scanme.nmap.org (
            Host is up.
           -Not shown: 95 filtered ports
           +Not shown: 993 filtered ports
            22/tcp    open   ssh
            25/tcp    closed smtp
            53/tcp    open   domain
           +70/tcp    closed gopher
            80/tcp    open   http
           +|_ html-title: Go ahead and ScanMe!
            113/tcp   closed auth
           +31337/tcp closed Elite

       Changes are marked by a - or + at the beginning of a line. We can
       see from the output that the scan without the -F fast scan option
       found two additional ports: 70 and 31337. The html-title script
       produced some additional output for port 80. From the port
       counts, we may infer that the fast scan scanned 100 ports (95
       filtered, 3 open, and 2 closed), while the normal scan scanned
       1000 (993 filtered, 3 open, and 4 closed).

       The -v (or --verbose) option to Ndiff made it show even the ports
       that didn't change, like 22 and 25. Without -v, they would not
       have been shown.

OUTPUT         top

       There are two output modes: text and XML. Text output is the
       default, and can also be selected with the --text option. Text
       output resembles a unified diff of Nmap's normal terminal output.
       Each line is preceded by a character indicating whether and how
       it changed.  - means that the line was in the first scan but not
       in the second; + means it was in the second but not the first. A
       line that changed is represented by a - line followed by a +
       line. Lines that did not change are preceded by a blank space.

       Example 1 is an example of text output. Here, port 80 on the host
       photos-cache-snc1.facebook.com gained a service version (lighttpd
       1.5.0). The host at changed its reverse DNS name.
       The host at was completely absent in the first scan
       but came up in the second.

       Example 1. Ndiff text output

           -Nmap 4.85BETA3 at 2009-03-15 11:00
           +Nmap 4.85BETA4 at 2009-03-18 11:00

            photos-cache-snc1.facebook.com (
            Host is up.
            Not shown: 99 filtered ports
           -80/tcp open  http
           +80/tcp open  http    lighttpd 1.5.0

           -cm.out.snc1.tfbnw.net (
           +mailout-snc1.facebook.com (
            Host is up.
            Not shown: 100 filtered ports

           +Host is up.
           +Not shown: 98 filtered ports
           +80/tcp  open  http     Apache httpd 1.3.41.fb1
           +443/tcp open  ssl/http Apache httpd 1.3.41.fb1

       XML output, intended to be processed by other programs, is
       selected with the --xml option. It is based on Nmap's XML output,
       with a few additional elements to indicate differences. The XML
       document is enclosed in nmapdiff and scandiff elements. Host
       differences are enclosed in hostdiff tags and port differences
       are enclosed in portdiff tags. Inside a hostdiff or portdiff, a
       and b tags show the state of the host or port in the first scan
       (a) or the second scan (b).

       Example 2 shows the XML diff of the same scans shown above in
       Example 1. Notice how port 80 of photos-cache-snc1.facebook.com
       is enclosed in portdiff tags. For, the old hostname
       is in a tags and the new is in b. For the new host,
       there is a b in the hostdiff without a corresponding a,
       indicating that there was no information for the host in the
       first scan.

       Example 2. Ndiff XML output

           <?xml version="1.0" encoding="UTF-8"?>
           <nmapdiff version="1">
                   <status state="up"/>
                   <address addr="" addrtype="ipv4"/>
                     <hostname name="photos-cache-snc1.facebook.com"/>
                     <extraports count="99" state="filtered"/>
                       <port portid="80" protocol="tcp">
                         <state state="open"/>
                           <service name="http"/>
                           <service name="http" product="lighttpd" version="1.5.0"/>
                   <status state="up"/>
                   <address addr="" addrtype="ipv4"/>
                       <hostname name="cm.out.snc1.tfbnw.net"/>
                       <hostname name="mailout-snc1.facebook.com"/>
                     <extraports count="100" state="filtered"/>
                     <status state="up"/>
                     <address addr="" addrtype="ipv4"/>
                       <extraports count="98" state="filtered"/>
                       <port portid="80" protocol="tcp">
                         <state state="open"/>
                         <service name="http" product="Apache httpd"
                       <port portid="443" protocol="tcp">
                         <state state="open"/>
                         <service name="http" product="Apache httpd" tunnel="ssl"

PERIODIC DIFFS         top

       Using Nmap, Ndiff, cron, and a shell script, it's possible to
       scan a network daily and get email reports of the state of the
       network and changes since the previous scan.  Example 3 shows the
       script that ties it together.

       Example 3. Scanning a network periodically with Ndiff and cron

           OPTIONS="-v -T4 -F -sV"
           date=`date +%F`
           cd /root/scans
           nmap $OPTIONS $TARGETS -oA scan-$date > /dev/null
           if [ -e scan-prev.xml ]; then
                   ndiff scan-prev.xml scan-$date.xml > diff-$date
                   echo "*** NDIFF RESULTS ***"
                   cat diff-$date
           echo "*** NMAP RESULTS ***"
           cat scan-$date.nmap
           ln -sf scan-$date.xml scan-prev.xml

       If the script is saved as /root/scan-ndiff.sh, add the following
       line to root's crontab:

           0 12 * * * /root/scan-ndiff.sh

EXIT CODE         top

       The exit code indicates whether the scans are equal.

       •   0 means that the scans are the same in all the aspects Ndiff
           knows about.

       •   1 means that the scans differ.

       •   2 indicates a runtime error, such as the failure to open a

BUGS         top

       Report bugs to the nmap-dev mailing list at <dev@nmap.org>.

HISTORY         top

       Ndiff started as a project by Michael Pattrick during the 2008
       Google Summer of Code. Michael designed the program and led the
       discussion of its output formats. He wrote versions of the
       program in Perl and C++, but the summer ended shortly after it
       was decided to rewrite the program in Python for the sake of
       Windows (and Zenmap) compatibility. This Python version was
       written by David Fifield. James Levine released[1] a Perl script
       named Ndiff with similar functionality in 2000.

AUTHORS         top

       David Fifield <david@bamsoftware.com>

       Michael Pattrick <mpattrick@rhinovirus.org>

WEB SITE         top


NOTES         top

        1. released

COLOPHON         top

       This page is part of the nmap (a network scanner) project.
       Information about the project can be found at ⟨http://nmap.org/⟩.
       If you have a bug report for this manual page, send it to
       dev@nmap.org.  This page was obtained from the project's upstream
       Git mirror of the Subversion repository
       ⟨https://github.com/nmap/nmap⟩ on 2021-04-01.  (At that time, the
       date of the most recent commit that was found in the repository
       was 2021-03-21.)  If you discover any rendering problems in this
       HTML version of the page, or you believe there is a better or
       more up-to-date source for the page, or you have corrections or
       improvements to the information in this COLOPHON (which is not
       part of the original manual page), send a mail to

Ndiff                          10/05/2020                       NDIFF(1)