How do I parse nmap output to grab "port/proto name" of service

Dulus

Join Date: Feb 2012
Beans: 1

How do I parse nmap output to grab "port/proto name" of service
Hi there, i am using attached php script, to gather all available services on ip address, using nmap, through php web ui. i am stuck, i need help to parse the output which nmap is generating and store in some variables, i need the port number(example: 80), ip proto name (tcp/udp), and service name (http)

the output of nmap looks like this:

Starting Nmap 5.00 ( http://nmap.org ) at 2012-02-01 20:22 CET
Interesting ports on localhost (127.0.0.1):
Not shown: 65525 closed ports
PORT STATE SERVICE
21/tcp open ftp
53/tcp open domain
80/tcp open http
443/tcp open https
631/tcp open ipp
953/tcp open rndc
3306/tcp open mysql
9000/tcp open cslistener
10000/tcp open snet-sensor-mgmt
28029/tcp open unknown

Nmap done: 1 IP address (1 host up) scanned in 0.81 seconds

and i need do parse the port number, proto name and service name from it. i then need to store them in DB, but thats another problem right now i need to parse it.

so basically i just need these values parsed to some variables, so i can work with them

i am not a programmer nor a php programmer, but i have some basic understanding of programming (i did a bunch of programs in C#), an a complete linux newbie.

Weedpacket

All the lines in the nmap file that look like

953/tcp open rndc

// Assume $lines is an array of all of the lines in nmap's report.
$port_mappings = preg_grep('!^\d+/\S+ \S+ !', $lines); // get the interesting lines
$parsed_port_mappings = array();
foreach($port_mappings as $port_mapping)
{
    preg_match('!^(?P<port>\d+)/(?P<protocol>\S+) (?P<status>\S+) (?P<service>\S+)!', $port_mappings, $parsed_port_mappings[]);
}

// Just to see what we get
var_dump($parsed_port_mappings);

So for the example report, $parsed_port_mappings[2]['service'] is 'http'.

Dulus

I did this

	$lines = null;
		echo "vystup nmap-u s prikazom : " . $cfg->nmapcmd . ' ' . $args . ' 2>&1';
		system($cfg->nmapcmd . ' ' . $args . ' 2>&1');
//here the output is stored in $lines variable
		exec($cfg->nmapcmd . ' ' . $args . ' 2>&1',$lines); 
// just to show whats in $lines variable
		echo "<pre>" . var_export($lines, TRUE) . "</pre>\\n";

	// Assume $lines is an array of all of the lines in nmap's report.
	$port_mappings = preg_grep('!^\d+/\S+ \S+ !', $lines); // get the interesting lines
	$parsed_port_mappings = array();
	foreach($port_mappings as $port_mapping)
	{
		preg_match('!^(?P<port>\d+)/(?P<protocol>\S+) (?P<status>\S+) (?P<service>\S+)!', $port_mappings, $parsed_port_mappings[]);
	}

	// Just to see what we get
	var_dump($parsed_port_mappings);

and this tells me this :

Warning: preg_match() expects parameter 2 to be string, array given in /home/dulus/public_html/php-nmap-0.3/index.php on line 192

array(1) {
[0]=>
NULL

}

line 192 is : preg_match('!^{(?P<port>\d+)/(?P<protocol>\S+)} (?P<status>\S+) (?P<service>\S+)!', $port_mappings, $parsed_port_mappings[]);

so the second parameter needs to be an string not an array.

the output of my echo "<pre>" . var_export($lines, TRUE) . "</pre>\n"; function, which i have given there for testing is (it writes out the $lines which should be an array storing the nmap output):

array (
0 => '',
1 => 'Starting Nmap 5.00 ( http://nmap.org ) at 2012-02-02 11:28 CET',
2 => 'Interesting ports on localhost (127.0.0.1):',
3 => 'Not shown: 65527 closed ports',
4 => 'PORT STATE SERVICE',
5 => '21/tcp open ftp',
6 => '53/tcp open domain',
7 => '80/tcp open http',
8 => '443/tcp open https',
9 => '631/tcp open ipp',
10 => '953/tcp open rndc',
11 => '3306/tcp open mysql',
12 => '28029/tcp open unknown',
13 => '',
14 => 'Nmap done: 1 IP address (1 host up) scanned in 0.73 seconds',

)

Weedpacket

Typo on my part (weird: the code I copied it from doesn't have it):

            preg_match('!^(?P<port>\d+)/(?P<protocol>\S+) (?P<status>\S+) (?P<service>\S+)!', $port_mappings, $parsed_port_mappings[]);

[font=monospace]$port_mappings[/font] should of course be [font=monospace]$port_mapping[/font] (otherwise what was [font=monospace]$port_mapping[/font] and the loop for?)

Dulus

strangely the $parsed_port_mappings is empty, var_dump($parsed_port_mappings); shows this

 array(2) {
  [0]=>
  array(0) {
  }
  [1]=>
  array(0) {
  }
}

doing var_dump($lines); show this

array(17) {
  [0]=>
  string(0) ""
  [1]=>
  string(62) "Starting Nmap 5.00 ( http://nmap.org ) at 2012-02-02 15:20 CET"
  [2]=>
  string(43) "Interesting ports on localhost (127.0.0.1):"
  [3]=>
  string(29) "Not shown: 65525 closed ports"
  [4]=>
  string(23) "PORT      STATE SERVICE"
  [5]=>
  string(19) "21/tcp    open  ftp"
  [6]=>
  string(22) "53/tcp    open  domain"
  [7]=>
  string(20) "80/tcp    open  http"
  [8]=>
  string(21) "443/tcp   open  https"
  [9]=>
  string(19) "631/tcp   open  ipp"
  [10]=>
  string(20) "953/tcp   open  rndc"
  [11]=>
  string(21) "3306/tcp  open  mysql"
  [12]=>
  string(26) "9000/tcp  open  cslistener"
  [13]=>
  string(32) "10000/tcp open  snet-sensor-mgmt"
  [14]=>
  string(23) "28029/tcp open  unknown"
  [15]=>
  string(0) ""
  [16]=>
  string(59) "Nmap done: 1 IP address (1 host up) scanned in 0.73 seconds"
}

so the source array ($lines) is good i think, or is it ?

there may be som glitch in regexp matching, will try to make it work, if you have time look at it, and by the way, thank you for your effort for helping me, much appreciated

Dulus

just made some more dumps and:

var_dump($port_mappings);

array(2) {
  [13]=>
  string(32) "10000/tcp open  snet-sensor-mgmt"
  [14]=>
  string(23) "28029/tcp open  unknown"
}

this should be all the lines with port mappings right ?? but it is not...

var_dump($port_mapping);

string(23) "28029/tcp open  unknown"

what should be this ?

Weedpacket

Oh; there can be more than one space between parts; that bit of the formatting was lost without [noparse]

...

[/noparse] tags (though I should have thought of it).

'!^(?P<port>\d+)/(?P<protocol>\S+) +(?P<status>\S+) +(?P<service>\S+)!'

Dulus

Ok, thanks a million, now it is parsing good, showing proper values and i can access the properties good, but there is one more glitch

$port_mappings = preg_grep('!^\d+/\S+ \S+ !', $lines); // get the interesting lines

this line is supposed to get all the lines with services right ? but it gets only the last 2 (which has 5 digits as a port number, but that probably only a coincidence) as i showed in the previous post under var_dump($port_mappings);

Dulus

nevermind got it working, same problem, there were more spaces tehre so i added + and it works now.

kkobashi

If the format was fixed, why not:

1) Code to strip out the first four lines of text
2) Iterate over remaining lines using

<?php
$lineTokens = explode(" ", $lineOfText);
$portProto = explode("/", $lineTokens[1]);
$port = $portProto[1];
$protocol = $portProto[2];
?>

Dulus

Ok the format has changed a little, now it is

Starting Nmap 5.00 ( http://nmap.org ) at 2012-04-19 20:08 CEST
Interesting ports on 192.168.70.6:
Not shown: 1022 closed ports
PORT   STATE SERVICE
22/tcp open  ssh
23/tcp open  telnet

Interesting ports on 192.168.70.25:
Not shown: 1021 closed ports
PORT    STATE SERVICE
21/tcp  open  ftp
80/tcp  open  http
443/tcp open  https

Nmap done: 256 IP addresses (2 hosts up) scanned in 7.27 seconds

So as you see there are now multiple ip addresses with multiple sets of proto mappings, i now need to have ip addresses and their corresponding proto mappings, the code which weedpacket posted works like a charm, also on this changed format but a i cant distinguish which ip is attachjed to which proto mapping ... anyone can help, i am sure it is easy, but i am too tired from work (on other thiongs in my program) i cant see it here

Dulus

my code which currently parses nmap output is:

$port_mappings = preg_grep('!^\d+/\S+ +\S+ !', $lines); // get the interesting lines
		$parsed_port_mappings = array();
		foreach($port_mappings as $port_mapping)
		{
			preg_match('!^(?P<port>\d+)/(?P<protocol>\S+) +(?P<state>\S+) +(?P<service>\S+)!', $port_mapping, $parsed_port_mappings[]);
			$array_length++;
		}

$lines is a whole nmap output, which is posted above