UNIX for Dummies Questions & Answers

Hello Everyone!

I'm kind of new to parsing and would like extract a partial part of my nmap scan output so I can convert it to csv/excel:

My current file has two types of lines like this:

Code:

Nmap scan report for dns1 (1.1.1.1)
Nmap scan report for dns2 (2.2.2.2)
Nmap scan report for 3.3.3.3

I want to be able to extract it as :

Code:

dns1, 1.1.1.1
dns2, 2.2.2.2
3.3.3.3

The file has 100+ lines.

Any help is great appreciated! Thanks in advance

Code:

awk '{gsub(/.*for |\(|\)/,x);$1=$1}1' OFS=, file

If the format is fixed, then you may use the following as well:

Code:

awk -F' ' '{print $5", "$6}' input.txt

You probably want to learn how to do it yourself instead of getting a ready-made recipe, so i will explain it step by step:

The example line you have shown are treated by two steps:

1) remove the (fixed?) string "Nmap scan report for " from the beginning of the line.
2) add a comma between word 1 and the rest if there are more than two words.
3) Remove braces around IP-Addresses

Let us start with the first, which is easy: replace the fixed string with nothing. We "anchor" the fixed string we are searching for at the beginning of the line by using the "^" metacharacter (meaning "beginning of the line"):

Code:

sed 's/^Nmap scan report for //' /path/to/input

Let this run, observe the results and continue if you are satisfied with them. Note that we do NOT write anything to disk, so we can refine and repeat any change which is only close to what we want.

Next we add code for the comma: there are two words only if there is a sequence that goes "(any number of) non-blank characters, followed by a blank, followed by other non-blank characters". If we find such a sequence we change it by adding a comma before the blank. Replace "<b>" by literal blanks in the following:

Code:

sed 's/^Nmap scan report for //
    s/^\([^<b>][^<b>]*\) \([^<b>][^<b>]*\)/\1, \2/' /path/to/input

Now to the last part: removing the braces. First, let us find out what an "IP-Adress" looks like: 4 groups of numbers, divided by 3 dots:

Code:

[0-9][0-9][0-9]\.[0-9][0-9][0-9]\.[0-9][0-9][0-9]\.[0-9][0-9][0-9]

Upon closer inspection, the first digit in each number can only be 0-2 and the first two digits are optional:

Code:

[0-2]*[0-9]*[0-9]\.[0-2]*[0-9]*[0-9]\.[0-2]*[0-9]*[0-9]\.[0-2]*[0-9]*[0-9]

Let us seek for this and remove any braces surrounding it:

Code:

sed 's/^Nmap scan report for //
    s/^\([^<b>][^<b>]*\) \([^<b>][^<b>]*\)/\1, \2/
    s/(\([0-2]*[0-9]*[0-9]\.[0-2]*[0-9]*[0-9]\.[0-2]*[0-9]*[0-9]\.[0-2]*[0-9]*[0-9]\))/\1/' /path/to/input

Again, watch the output and check if this is indeed what you want. Finally, if you are satisfied with the result, save it to a file:

Code:

sed 's/^Nmap scan report for //
    s/^\([^<b>][^<b>]*\) \([^<b>][^<b>]*\)/\1, \2/
    s/(\([0-2]*[0-9]*[0-9]\.[0-2]*[0-9]*[0-9]\.[0-2]*[0-9]*[0-9]\.[0-2]*[0-9]*[0-9]\))/\1/' /path/to/input > /path/to/output

I hope this helps.

bakunin