how do use linq to xml pull data from complex xml with identical elements and attributes

Question

This is my first time using Linq to xml and I'm struggling with pulling some of the data from the xml file. the problem seems to be due to the way the xml is formatted ( which is out of my control ) in that it has eliments and attributes that are the same.

<host starttime="1357755777" endtime="1357755993">
    <status state="up" reason="arp-response"/>
    <address addr="192.168.1.1" addrtype="ipv4"/>
    <address addr="00:50:56:90:77:9F" addrtype="mac" vendor="VMware"/>
    <hostnames>
        <hostname name="test1.test.com" type="PTR"/>
    </hostnames>
    <ports>
        <extraports state="closed" count="95">
            <extrareasons reason="resets" count="95"/>
        </extraports>
        <port protocol="tcp" portid="135">
            <state state="open" reason="syn-ack" reason_ttl="128"/>
            <service name="msrpc" product="Microsoft Windows RPC" ostype="Windows" method="probed" conf="10">
                <cpe>cpe:/o:microsoft:windows</cpe>
            </service>
        </port>
        <port protocol="tcp" portid="139">
            <state state="open" reason="syn-ack" reason_ttl="128"/>
            <service name="netbios-ssn" method="probed" conf="10"/>
        </port>
        <port protocol="tcp" portid="445">
            <state state="open" reason="syn-ack" reason_ttl="128"/>
            <service name="microsoft-ds" product="Microsoft Windows 2003 or 2008 microsoft-ds" ostype="Windows" method="probed" conf="10">
                <cpe>cpe:/o:microsoft:windows</cpe>
            </service>
        </port>
        <port protocol="tcp" portid="3389">
            <state state="open" reason="syn-ack" reason_ttl="128"/>
            <service name="ms-wbt-server" product="Microsoft Terminal Service" ostype="Windows" method="probed" conf="10"/>
        </port>
        <port protocol="tcp" portid="8081">
            <state state="open" reason="syn-ack" reason_ttl="128"/>
            <service name="http" product="Network Associates ePolicy Orchestrator" method="probed" conf="10"/>
        </port>
    </ports>
</host>
<host starttime="1357755777" endtime="1357755993">
    <status state="up" reason="arp-response"/>
    <address addr="192.168.1.2" addrtype="ipv4"/>
    <address addr="00:50:56:90:67:8F" addrtype="mac" vendor="VMware"/>
    <hostnames>
        <hostname name="test2.test.com" type="PTR"/>
    </hostnames>
    <ports>
        <extraports state="closed" count="97">
            <extrareasons reason="resets" count="97"/>
        </extraports>
        <port protocol="tcp" portid="53">
            <state state="open" reason="syn-ack" reason_ttl="64"/>
            <service name="domain" product="dnsmasq" version="2.33" method="probed" conf="10">
                <cpe>cpe:/a:thekelleys:dnsmasq:2.33</cpe>
            </service>
            <script id="dns-nsid" output="&#xa;  bind.version: dnsmasq-2.33&#xa;"/>
        </port>
        <port protocol="tcp" portid="81">
            <state state="open" reason="syn-ack" reason_ttl="64"/>
            <service name="http" product="Apache httpd" method="probed" conf="10">
                <cpe>cpe:/a:apache:http_server</cpe>
            </service>
            <script id="http-title" output="Did not follow redirect to https://192.168.100.14:445/ and no page was returned."/>
            <script id="http-favicon" output="Unknown favicon MD5: 95CDE3E49C5B2645F99AAAAABB6CD4C6"/>
            <script id="http-methods" output="No Allow or Public header in OPTIONS response (status code 403)"/>
        </port>
        <port protocol="tcp" portid="445">
            <state state="open" reason="syn-ack" reason_ttl="64"/>
            <service name="http" product="Apache httpd" method="probed" conf="10">
                <cpe>cpe:/a:apache:http_server</cpe>
            </service>
            <script id="http-title" output="400 Bad Request"/>
            <script id="http-methods" output="No Allow or Public header in OPTIONS response (status code 403)"/>
        </port>
    </ports>
</host>

above is a sample of the XML I have to work with I'm simplified it a little for this question, the output is from nmap.

The data I need from the XML is as follows. For each host status/state address/addr for addrtype ipv4 address/addr and address/vendor for addrtype mac each of the port/portid's

    XDocument NmapScan = XDocument.Load(file);

    var data = from item in NmapScan.Descendants("host")
         select new 
         {
             status = item.Element("status").Attribute("state").Value,
             ip = item.Element("address").Attribute("addr").Value,
             iptype = item.Element("address").Attribute("addrtype").Value
         };

                foreach (var p in data)
                    Debug.WriteLine(p.ToString());

every tutorial I've found don't seen to go in to this for this type of XML. I can get the first entry of each type but not the 2nd. I've not been able to find a way to iterate through each of them. What I would like would be to have this for output

status = up, ip = 192.168.100.171, iptype = ipv4, port = 22, port = 80

The lack of indentation in your XML and the odd indentation in your code make both hard to read. — Jon Skeet, Jan 27 '13 at 15:40

score 0 · Answer 1 · edited May 23 '17 at 11:49

0

You can do new selects within the original select. See the example in the answer for How to deserialize only part of a large xml file to c# classes?

edited May 23 '17 at 11:49

Community

1
1

answered Jan 27 '13 at 15:42

flup

26,937
7
52
74

Cédric Bignon · Answer 2 · 2013-01-27T16:04:47.607

Using LINQ:

foreach (XElement hostElement in NmapScan.Descendants("host"))
{
    // Gets the XElement "address" that have the attribute "addrtype" set to "mac"
    XElement macAddressElement = (from addressElement in hostElement.Elements("address")
                                    where addressElement.Attribute("addrtype").Value == "mac"
                                    select addressElement).Single();

    // Gets the XElement "address" that have the attribute "addrtype" set to "ipv4"
    XElement ipV4AdressElement = (from addressElement in hostElement.Elements("address")
                                    where addressElement.Attribute("addrtype").Value == "ipv4"
                                    select addressElement).Single();

    var p = new
    {
        status = hostElement.Element("status").Attribute("state").Value,
        addrIpv4 = ipV4AdressElement.Attribute("addr").Value,
        addrMac = macAddressElement.Attribute("addr").Value,
        addrVendor = macAddressElement.Attribute("vendor").Value,
        ports = (from portElement in hostElement.Element("ports").Elements("port")
                    select portElement.Attribute("portid").Value).ToList()
    };

    Console.WriteLine(p);
}

Excellent Cedric, till try that out shortly – Drknite72 Jan 27 '13 at 18:23 — Drknite72, Jan 27 '13 at 18:23

how do use linq to xml pull data from complex xml with identical elements and attributes

2 Answers2