1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
|
<HTML>
<HEAD>
<TITLE>ndiff - find differences between two nmap network scans</TITLE>
<LINK REV="made" HREF="mailto:root@porky.devel.redhat.com">
</HEAD>
<BODY>
<!-- INDEX BEGIN -->
<UL>
<LI><A HREF="#NAME">NAME</A>
<LI><A HREF="#SYNOPSIS">SYNOPSIS</A>
<LI><A HREF="#DESCRIPTION">DESCRIPTION</A>
<LI><A HREF="#OPTIONS">OPTIONS</A>
<LI><A HREF="#DATA_STORES">DATA STORES</A>
<LI><A HREF="#SUBSTITUTIONS">SUBSTITUTIONS</A>
<LI><A HREF="#BUGS">BUGS</A>
<LI><A HREF="#AUTHOR">AUTHOR</A>
</UL>
<!-- INDEX END -->
<HR>
<P>
<H1><A NAME="NAME">NAME</A></H1>
<P>
ndiff - find differences between two nmap network scans
<P>
<HR>
<H1><A NAME="SYNOPSIS">SYNOPSIS</A></H1>
<P>
<PRE> ndiff [-b|-baseline <file-or-:tag>] [-o|-observed <file-or-:tag>]
[-op|-output-ports <ocufx>] [-of|-output-hosts <nmc>]
[-fmt|-format <terse | minimal | verbose | machine | html | htmle>]
</PRE>
<P>
<HR>
<H1><A NAME="DESCRIPTION">DESCRIPTION</A></H1>
<P>
ndiff allows a network administrator or other interested party to easily
monitor one or more networks for changes in port states and running
services. It achieves this by comparing the results of two nmap scans, one
designated the ``baseline'', the other ``observation''.
<P>
Both baseline and observation are stored in files generated via nmap's -m
switch.
<P>
<HR>
<H1><A NAME="OPTIONS">OPTIONS</A></H1>
<DL>
<DT><STRONG><A NAME="item__b">-b <filename-or-:tag></A></STRONG><DD>
<DT><STRONG><A NAME="item__baseline">-baseline <filename-or-:tag></A></STRONG><DD>
<P>
Specifies the nmap results to use as the baseline for the comparison.
Normally this is the name of an nmap machine-parseable file, but if the
parameter starts with a colon (:), it is treated as a key into a data
store. See <A HREF="#DATA_STORES">DATA STORES</A>
below for more information.
<P>
See <A HREF="#SUBSTITUTIONS">SUBSTITUTIONS</A> below for information about using %-style expansions within filenames and
:tags.
<DT><STRONG><A NAME="item__o">-o <filename-or-:tag></A></STRONG><DD>
<DT><STRONG><A NAME="item__observed">-observed <filename-or-:tag></A></STRONG><DD>
<P>
Specifies the nmap results to use as the ``observed results'' for the
comparison. Normally this is the name of an nmap machine-parseable file,
but if the parameter starts with a colon (:), it is treated as a key into a
data store. See <A HREF="#DATA_STORES">DATA STORES</A>
below for more information.
<P>
See <A HREF="#SUBSTITUTIONS">SUBSTITUTIONS</A> below for information about using %-style expansions within filenames and
:tags.
<DT><STRONG><A NAME="item__fmt">-fmt <terse | minimal | verbose | machine | html | htmle></A></STRONG><DD>
<DT><STRONG><A NAME="item__format">-format <terse | minimal | verbose | machine | html | htmle></A></STRONG><DD>
<P>
Specifies the level of detail in the output. ``html'' causes ndiff to
generate an html page, while ``htmle'' causes ndiff to generate an
embeddable html fragment (See <EM>ndiff2html</EM>).
<DT><STRONG><A NAME="item__op">-op [ocufx]</A></STRONG><DD>
<DT><STRONG><A NAME="item__output_ports">-output-ports [ocufk]</A></STRONG><DD>
<P>
Specifies which ports to display when outputting changed hosts. Any
combination of the characters [ocufx] may be specified to enable printing
of ports that changed to states (in the ``observed'' scan) as follows:
<P>
<PRE> o = open
c = closed
f = filtered
x = unfiltered
k = unknown (wasn't scanned or host wasn't up)
</PRE>
<DT><STRONG><A NAME="item__oh">-oh [nmc]</A></STRONG><DD>
<DT><STRONG><A NAME="item__output_hosts">-output-hosts [nmc]</A></STRONG><DD>
<P>
Specifies which types hosts to display. Any combination of [nmc] may be
specified, as follows:
<P>
<PRE> n = new hosts (in the "observed" scan)
m = missing hosts ( " " " )
c = changed hosts ( " " " )
</PRE>
<DT><STRONG><A NAME="item__of">-of <file></A></STRONG><DD>
<DT><STRONG><A NAME="item__output_file">-output-file <file></A></STRONG><DD>
<P>
Send the output to the specified file. % substitutions are supported in the
filename, see <A HREF="#SUBSTITUTIONS">SUBSTITUTIONS</A> below.
</DL>
<P>
<HR>
<H1><A NAME="DATA_STORES">DATA STORES</A></H1>
<P>
Nrun and its related tools can manipulate results in regular nmap-format
files, in any user-specified location, or they can handle storing and
organizing the data on behalf of the user, through a user-configurable
``data store''.
<P>
Whenever you precede a results tag with a colon (:), the tag will be
treated as a unique key into a data store, identifying the results set.
<P>
Currently the only supported data store is nmap format files placed in a
preconfigured directory. Other types may be added at a later date.
<P>
A legal tag may contain any alphanumeric string, plus dash, underscore, and
dot. %-style substitutions in the ilk of the ``date'' command are also
supported, allowing a tag to contain date, time, or the local hostname. See <A HREF="#SUBSTITUTIONS">SUBSTITUTIONS</A>
below for more information.
<P>
<HR>
<H1><A NAME="SUBSTITUTIONS">SUBSTITUTIONS</A></H1>
<P>
%-style substitutions supported in tags as follows:
<DL>
<DT><STRONG><A NAME="item__H">%H = hour</A></STRONG><DD>
<DT><STRONG><A NAME="item__M">%M = minute</A></STRONG><DD>
<DT><STRONG><A NAME="item__S">%S = second</A></STRONG><DD>
<DT><STRONG><A NAME="item__D">%D = day of month</A></STRONG><DD>
<DT><STRONG><A NAME="item__m">%m = month of year (01-12)</A></STRONG><DD>
<DT><STRONG><A NAME="item__Y">%Y = year, four digits</A></STRONG><DD>
<DT><STRONG><A NAME="item__j">%j = day of year, three digits</A></STRONG><DD>
<DT><STRONG><A NAME="item__w">%w = day of week (0-6) one digit</A></STRONG><DD>
</DL>
<P>
Except where noted, the above items are two digits, and local time. All are
zero-padded as appropriate.
<P>
In addtion-
<DL>
<DT><STRONG><A NAME="item__F">%F = output of "hostname" on the local machine</A></STRONG><DD>
</DL>
<P>
<HR>
<H1><A NAME="BUGS">BUGS</A></H1>
<P>
It's too slow -- approx 3 scanned hosts per second on a Pentium II-300. No
support for human-readable hostnames and portnames. Port/protocol output
formatting is inconsistent in certain places.
<P>
<HR>
<H1><A NAME="AUTHOR">AUTHOR</A></H1>
<P>
James Levine <<A HREF="mailto:jdl@vinecorp.com">jdl@vinecorp.com</A>>
</BODY>
</HTML>
|
