blocks|key|253503|text|最好使用通用编程语言(python、perl、awk)，在这种语言中，您可以在看到"scan+report+for“关键字时捕获IP地址，然后维护一个将服务名称映射到运行这些服务的IP地址列表的数据结构。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|253504|例如，在给定该输出的情况下，下面的perl一行程序(没有提供任何解释)|253505|perl+-ne+'
++++if+(/Nmap+scan+report+for+.*?(\d%2B\.\d%2B\.\d%2B\.\d%2B)/)+{
++++++++$ip+=+$1
++++}
++++elsif+(/%5E(\d%2B)\/tcp\s%2Bopen\s%2B(.*)/)+{
++++++++push+@{$services{"$1/$2"}},+$ip
++++}
++++END+{
++++++++for+$svc+(sort+{$a+<=>+$b}+keys+%25services)+{
++++++++++++printf+"%25s\n%25s\n\n",+$svc,+join("\n",+@{$services{$svc}})
++++++++}
++++}
'|code-block|syntax|javascript|253506|产生|253507|22/ssh
192.168.1.1
192.168.1.2

53/domain
192.168.1.1

80/http
192.168.1.2

139/netbios-ssn
192.168.1.2

427/svrloc
192.168.1.1

445/microsoft-ds
192.168.1.2

1900/upnp
192.168.1.1|253508|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|Q|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|R|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|S|8|@]|9|@]|A|$G|H]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

You'd be better served using a general purpose programming language (python, perl, awk) where you can capture the IP address when you see the "scan report for" keywords, and then maintain a data structure mapping the service names to the list of IP addresses running those services.

For example, given that output, this perl one-liner (offered without explanation)

<pre><code>perl -ne '
 if (/Nmap scan report for .*?(\d+\.\d+\.\d+\.\d+)/) {
 $ip = $1
 }
 elsif (/^(\d+)\/tcp\s+open\s+(.*)/) {
 push @{$services{"$1/$2"}}, $ip
 }
 END {
 for $svc (sort {$a &lt;=&gt; $b} keys %services) {
 printf "%s\n%s\n\n", $svc, join("\n", @{$services{$svc}})
 }
 }
'
</code></pre>

produces

<pre><code>22/ssh
192.168.1.1
192.168.1.2

53/domain
192.168.1.1

80/http
192.168.1.2

139/netbios-ssn
192.168.1.2

427/svrloc
192.168.1.1

445/microsoft-ds
192.168.1.2

1900/upnp
192.168.1.1
</code></pre>

blocks|key|557147|text|$+cat+tst.awk
BEGIN+{+FS="[[:space:]/]%2B"+}

/Nmap+scan+report/+{
++++ip+=+$NF
++++gsub(/[()]/,"",ip)
}

/tcp.*open/+{
++++key+=+$1+"/"+$4
++++ips[key]+=+(key+in+ips+?+ips[key]+ORS+:+"")+ip
}

END+{
++++for+(key+in+ips)+{
++++++++print+key
++++++++print+"===="
++++++++print+ips[key]
++++++++print+""
++++}
}|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|557148|。|unstyled|557149|$+awk+-f+tst.awk+file
80/http
====
192.168.1.2

1900/upnp
====
192.168.1.1

427/svrloc
====
192.168.1.1

445/microsoft-ds
====
192.168.1.2

53/domain
====
192.168.1.1

22/ssh
====
192.168.1.1
192.168.1.2

139/netbios-ssn
====
192.168.1.2|557150|我认为它在做什么是非常明显的，但是如果您在看了几眼awk手册页后有任何问题，请随时提问。|557151|上面的代码可以在每个UNIX系统上的任何shell中使用任何awk。|557152|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$B|C]]|$1|D|3|E|5|F|7|P|8|@]|9|@]|A|$]]|$1|G|3|H|5|6|7|Q|8|@]|9|@]|A|$B|C]]|$1|I|3|J|5|F|7|R|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|S|8|@]|9|@]|A|$]]|$1|M|3|-4|5|F|7|T|8|@]|9|@]|A|$]]]|N|$]]

<pre><code>$ cat tst.awk
BEGIN { FS="[[:space:]/]+" }

/Nmap scan report/ {
 ip = $NF
 gsub(/[()]/,"",ip)
}

/tcp.*open/ {
 key = $1 "/" $4
 ips[key] = (key in ips ? ips[key] ORS : "") ip
}

END {
 for (key in ips) {
 print key
 print "===="
 print ips[key]
 print ""
 }
}
</code></pre>

.

<pre><code>$ awk -f tst.awk file
80/http
====
192.168.1.2

1900/upnp
====
192.168.1.1

427/svrloc
====
192.168.1.1

445/microsoft-ds
====
192.168.1.2

53/domain
====
192.168.1.1

22/ssh
====
192.168.1.1
192.168.1.2

139/netbios-ssn
====
192.168.1.2
</code></pre>

I think it's extremely obvious what it's doing but if you have any questions after maybe a few glances at the awk man page then feel free to ask.

The above will work using any awk in any shell on every UNIX system.

A project to familiarize myself that I'm working on is to parse through an <code>nmap</code> result.

(I know of the <code>-oG</code> option, but I'm working with <code>grep</code>, <code>awk</code>, <code>for</code>, and <code>while</code> loops here).

Below is what I'm trying to parse through:

<pre><code>Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-05 11:26 EST
Nmap scan report for house.router.nick (192.168.1.1)


Host is up (0.00059s latency).
Not shown: 995 closed ports
PORT STATE SERVICE
22/tcp open ssh
53/tcp open domain
427/tcp open svrloc
1900/tcp open upnp

MAC Address: 50:C7:BF:A8:CF:C8 (Tp-link Technologies)


Nmap scan report for 192.168.1.2


Host is up (0.00034s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
139/tcp open netbios-ssn
445/tcp open microsoft-ds

MAC Address: 48:F8:B3:C9:AE:BB (Cisco-Linksys)
</code></pre>

What I want to get is this:

<pre><code>22/ssh
====
192.168.1.1
192.168.1.2

http
===
192.168.1.2
</code></pre>

So far, I have this:

<pre><code>grep -E "tcp.*open" nmap.txt | awk '{ print $3 }' | sort | uniq
</code></pre>

For the life of me, I can't figure out how to get this into a loop of sorts and get the desired output from above. 

Can you please help me learn and explain why you came to the solution you did? No point in getting a potential solution if I can't understand the logic behind it.

Parsing nmap output

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我正在做的一个熟悉项目就是解析nmap结果。(我知道-oG选项，但我在这里使用的是grep、awk、for和while循环)。下面是我试图解析的内容：Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-05 11:26 ESTNmap scan report for h...

问解析nmap输出
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问解析nmap输出EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问解析nmap输出
EN