# ndiff

## NAME



           ndiff - Utility to compare the results of Nmap scans
    


## SYNOPSIS



    
           **ndiff**[_options_] {_a.xml_} {_b.xml_}
    


## DESCRIPTION



           Ndiff is a tool to aid in the comparison of Nmap scans. It takes
           two Nmap XML output files and prints the differences between them.
           The differences observed are:
    
           •   Host states (e.g. up to down)
    
           •   Port states (e.g. open to closed)
    
           •   Service versions (from **-sV**)
    
           •   OS matches (from **-O**)
    
           •   Script output
    
           Ndiff, like the standard **diff** utility, compares two scans at a
           time.
    


## OPTIONS SUMMARY



           **-h** , **--help**
               Show a help message and exit.
    
           **-v** , **--verbose**
               Include all hosts and ports in the output, not only those that
               have changed.
    
           **--text**
               Write output in human-readable text format.
    
           **--xml**
               Write output in machine-readable XML format. The document
               structure is defined in the file ndiff.dtd included in the
               distribution.
    
           Any other arguments are taken to be the names of Nmap XML output
           files. There must be exactly two.
    


## EXAMPLE



           Let's use Ndiff to compare the output of two Nmap scans that use
           different options. In the first, we'll do a fast scan (**-F**), which
           scans fewer ports for speed. In the second, we'll scan the larger
           default set of ports, and run an NSE script.
    
               # **nmap -F scanme.nmap.org -oX scanme-1.xml**
               # **nmap --script=html-title scanme.nmap.org -oX scanme-2.xml**
               $ **ndiff -v scanme-1.xml scanme-2.xml**
               -Nmap 5.35DC1 at 2010-07-16 12:09
               +Nmap 5.35DC1 at 2010-07-16 12:13
    
                scanme.nmap.org (64.13.134.52):
                Host is up.
               -Not shown: 95 filtered ports
               +Not shown: 993 filtered ports
                PORT      STATE  SERVICE VERSION
                22/tcp    open   ssh
                25/tcp    closed smtp
                53/tcp    open   domain
               +70/tcp    closed gopher
                80/tcp    open   http
               +|_ html-title: Go ahead and ScanMe!
                113/tcp   closed auth
               +31337/tcp closed Elite
    
           Changes are marked by a - or + at the beginning of a line. We can
           see from the output that the scan without the **-F** fast scan option
           found two additional ports: 70 and 31337. The html-title script
           produced some additional output for port 80. From the port counts,
           we may infer that the fast scan scanned 100 ports (95 filtered, 3
           open, and 2 closed), while the normal scan scanned 1000 (993
           filtered, 3 open, and 4 closed).
    
           The **-v**(or **--verbose**) option to Ndiff made it show even the ports
           that didn't change, like 22 and 25. Without **-v** , they would not
           have been shown.
    


## OUTPUT



           There are two output modes: text and XML. Text output is the
           default, and can also be selected with the **--text** option. Text
           output resembles a unified diff of Nmap's normal terminal output.
           Each line is preceded by a character indicating whether and how it
           changed.  - means that the line was in the first scan but not in
           the second; + means it was in the second but not the first. A line
           that changed is represented by a - line followed by a + line.
           Lines that did not change are preceded by a blank space.
    
           Example 1 is an example of text output. Here, port 80 on the host
           photos-cache-snc1.facebook.com gained a service version (lighttpd
           1.5.0). The host at 69.63.179.25 changed its reverse DNS name. The
           host at 69.63.184.145 was completely absent in the first scan but
           came up in the second.
    
           **Example 1. Ndiff text output**
    
               -Nmap 4.85BETA3 at 2009-03-15 11:00
               +Nmap 4.85BETA4 at 2009-03-18 11:00
    
                photos-cache-snc1.facebook.com (69.63.178.41):
                Host is up.
                Not shown: 99 filtered ports
                PORT   STATE SERVICE VERSION
               -80/tcp open  http
               +80/tcp open  http    lighttpd 1.5.0
    
               -cm.out.snc1.tfbnw.net (69.63.179.25):
               +mailout-snc1.facebook.com (69.63.179.25):
                Host is up.
                Not shown: 100 filtered ports
    
               +69.63.184.145:
               +Host is up.
               +Not shown: 98 filtered ports
               +PORT    STATE SERVICE  VERSION
               +80/tcp  open  http     Apache httpd 1.3.41.fb1
               +443/tcp open  ssl/http Apache httpd 1.3.41.fb1
    
           XML output, intended to be processed by other programs, is
           selected with the **--xml** option. It is based on Nmap's XML output,
           with a few additional elements to indicate differences. The XML
           document is enclosed in _nmapdiff_ and _scandiff_ elements. Host
           differences are enclosed in _hostdiff_ tags and port differences are
           enclosed in _portdiff_ tags. Inside a _hostdiff_ or _portdiff_ , _a_ and _b_
           tags show the state of the host or port in the first scan (_a_) or
           the second scan (_b_).
    
           Example 2 shows the XML diff of the same scans shown above in
           Example 1. Notice how port 80 of photos-cache-snc1.facebook.com is
           enclosed in _portdiff_ tags. For 69.63.179.25, the old hostname is
           in _a_ tags and the new is in _b_. For the new host 69.63.184.145,
           there is a _b_ in the _hostdiff_ without a corresponding _a_ , indicating
           that there was no information for the host in the first scan.
    
           **Example 2. Ndiff XML output**
    
               <?xml version="1.0" encoding="UTF-8"?>
               <nmapdiff version="1">
                 <scandiff>
                   <hostdiff>
                     <host>
                       <status state="up"/>
                       <address addr="69.63.178.41" addrtype="ipv4"/>
                       <hostnames>
                         <hostname name="photos-cache-snc1.facebook.com"/>
                       </hostnames>
                       <ports>
                         <extraports count="99" state="filtered"/>
                         <portdiff>
                           <port portid="80" protocol="tcp">
                             <state state="open"/>
                             <a>
                               <service name="http"/>
                             </a>
                             <b>
                               <service name="http" product="lighttpd" version="1.5.0"/>
                             </b>
                           </port>
                         </portdiff>
                       </ports>
                     </host>
                   </hostdiff>
                   <hostdiff>
                     <host>
                       <status state="up"/>
                       <address addr="69.63.179.25" addrtype="ipv4"/>
                       <hostnames>
                         <a>
                           <hostname name="cm.out.snc1.tfbnw.net"/>
                         </a>
                         <b>
                           <hostname name="mailout-snc1.facebook.com"/>
                         </b>
                       </hostnames>
                       <ports>
                         <extraports count="100" state="filtered"/>
                       </ports>
                     </host>
                   </hostdiff>
                   <hostdiff>
                     <b>
                       <host>
                         <status state="up"/>
                         <address addr="69.63.184.145" addrtype="ipv4"/>
                         <ports>
                           <extraports count="98" state="filtered"/>
                           <port portid="80" protocol="tcp">
                             <state state="open"/>
                             <service name="http" product="Apache httpd"
                                      version="1.3.41.fb1"/>
                           </port>
                           <port portid="443" protocol="tcp">
                             <state state="open"/>
                             <service name="http" product="Apache httpd" tunnel="ssl"
                                      version="1.3.41.fb1"/>
                           </port>
                         </ports>
                       </host>
                     </b>
                   </hostdiff>
                 </scandiff>
               </nmapdiff>
    


## PERIODIC DIFFS



           Using Nmap, Ndiff, cron, and a shell script, it's possible to scan
           a network daily and get email reports of the state of the network
           and changes since the previous scan.  Example 3 shows the script
           that ties it together.
    
           **Example 3. Scanning a network periodically with Ndiff and cron**
    
               #!/bin/sh
               TARGETS="_targets_ "
               OPTIONS="-v -T4 -F -sV"
               date=`date +%F`
               cd /root/scans
               nmap $OPTIONS $TARGETS -oA scan-$date > /dev/null
               if [ -e scan-prev.xml ]; then
                       ndiff scan-prev.xml scan-$date.xml > diff-$date
                       echo "*** NDIFF RESULTS ***"
                       cat diff-$date
                       echo
               fi
               echo "*** NMAP RESULTS ***"
               cat scan-$date.nmap
               ln -sf scan-$date.xml scan-prev.xml
    
           If the script is saved as /root/scan-ndiff.sh, add the following
           line to root's crontab:
    
               0 12 * * * /root/scan-ndiff.sh
    


## EXIT CODE



           The exit code indicates whether the scans are equal.
    
           •   0 means that the scans are the same in all the aspects Ndiff
               knows about.
    
           •   1 means that the scans differ.
    
           •   2 indicates a runtime error, such as the failure to open a
               file.
    


## BUGS



           Report bugs to the nmap-dev mailing list at <dev@nmap.org>.
    


## WEB SITE



           **https://nmap.org/ndiff/ **
    


## NOTES



            1. released
               https://seclists.org/nmap-hackers/2000/315
    


* * *