grep IP adress with open port nmap

Question

I'm trying to make this script to grep IP adresses with open port from nmap but I can't do it the right way.

I have something like this:

nmap 192.168.0.0/24 -sU -p 44555 | grep -oP "([0-9]{1,3}\.){3}[0-9]{1,3}"  >output.txt

But this is taking all IP's open and closed.

example output nmap:

Nmap scan report for 79-119-0-248.rdsnet.ro (79.119.0.248)
Host is up (0.033s latency).
PORT      STATE         SERVICE
27023/udp open|filtered unknown

Nmap scan report for 79-119-0-249.rdsnet.ro (79.119.0.249)
Host is up (0.032s latency).
PORT      STATE  SERVICE
27023/udp closed unknown

Only the ones are open/filtered I want Thanks

I don't have on the network output yet so tried another range — user3297864, Feb 24 '14 at 01:35
I'm sorry I think I misunderstood you question: in the following case you only want the first ip? — Martin Delille, Feb 24 '14 at 01:54
Don't forget to accept an answer by clicking the tick under the correct answer. — aidan, Feb 24 '14 at 03:35
Don't forget to accept an answer by clicking the tick under the correct answer. — MLSC, Feb 24 '14 at 05:11
possible duplicate of [Output IP only from an nmap scan on open port](http://stackoverflow.com/questions/18130022/output-ip-only-from-an-nmap-scan-on-open-port) — tripleee, Feb 24 '14 at 05:53

Martin Delille · Accepted Answer · 2014-02-24T01:55:40.250

3

It works with egrep :

nmap 192.168.0.0/24 -sU -p 44555 | grep -B3 open | egrep -o "([0-9]{1,3}\.){3}[0-9]{1,3}"  > output.txt

edited Feb 24 '14 at 01:55

answered Feb 24 '14 at 01:46

Martin Delille

11,360
15
65
132

MLSC · Answer 2 · 2014-02-24T05:21:00.127

0

If you want to just get open ip you can try the following code(surely works):

nmap 192.168.0.0/24 -sU -p 44555 | grep '^44555.*open' -B3 | grep '^Nmap scan' | cut -d\( -f2 | cut -d\) -f1 > output.txt

edited Feb 24 '14 at 05:21

answered Feb 24 '14 at 04:43

MLSC

5,872
8
55
89

BMW · Answer 3 · 2014-02-24T10:50:24.687

0

Using awk

nmap 192.168.0.0/24 -sU -p 44555|awk  '/(open|filtered)/{print $2}' RS="Nmap" FS="[)(]"

Explanation

RS="Nmap" - set work Nmap as record Separator variable
FS="[)(]"set parentheses as field separators
/(open|filtered)/{print $2} If the record has open or filtered, print column 2.

edited Feb 24 '14 at 10:50

answered Feb 24 '14 at 10:45

BMW

42,880
12
99
116

grep IP adress with open port nmap

3 Answers3

Explanation

Linked