Introduction
When conducting penetration tests or network security assessments, running scans is only half the battle. Properly documenting and saving your scan results is crucial for reporting, tracking progress, and feeding data into other security tools.
Output format choice affects what you can do next with your results. Human-readable output is best for quick review. Structured output is best for automation. Mature workflows usually preserve both.
Nmap, the industry-standard network mapper, provides several output formats to suit different needs. The three most common formats are Normal (human-readable), Grepable (designed for command-line parsing), and XML (structured data for importing into other software).
In this lab, you will learn how to generate these three output formats and how to use basic Linux command-line tools to parse the results and extract valuable information.
Output to Normal Format (-oN)
In this step, you will learn how to save Nmap scan results in the Normal format. The Normal format is essentially a direct copy of what you see on your terminal screen when you run an Nmap scan. It is highly readable and perfect for quickly reviewing results or sharing them with colleagues in a text document.
This format is optimized for people, not pipelines. It is the right choice when the immediate consumer is a human analyst reading the scan as a report.
To save your scan results in Normal format, you use the -oN flag followed by the name of the file you want to create. We will scan our local machine (127.0.0.1) to discover open ports and save the output.
Run the following command in your terminal to perform a scan and save it as normal_scan.txt:
nmap -p 22,8080 -oN normal_scan.txt 127.0.0.1
After the scan completes, you can view the contents of the file using the cat command. This will display the exact same output that was printed to your screen during the scan.
cat normal_scan.txt
You should see an output similar to this, showing the open ports and their associated services:
## Nmap 7.80 scan initiated Sat Mar 7 16:07:07 2026 as: nmap -p 22,8080 -oN normal_scan.txt 127.0.0.1
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000057s latency).
PORT STATE SERVICE
22/tcp open ssh
8080/tcp open http-proxy
## Nmap done at Sat Mar 7 16:07:07 2026 -- 1 IP address (1 host up) scanned in 0.02 seconds
Output to Grepable Format (-oG)
In this step, you will explore the Grepable output format. While the Normal format is great for human eyes, it is difficult to process programmatically because the information spans multiple lines. The Grepable format solves this by placing all the information for a single host on a single, long line.
Flattening the data like this makes shell-based parsing practical. It is a classic example of shaping output for downstream tooling rather than for direct reading comfort.
This format is specifically designed to be used with Linux command-line tools like grep, awk, and cut. To generate Grepable output, you use the -oG flag.
Execute the following command to run the same scan, but this time save the results in Grepable format as grepable_scan.txt:
nmap -p 22,8080 -oG grepable_scan.txt 127.0.0.1
Now, view the contents of the newly created file:
cat grepable_scan.txt
The output will look quite different from the Normal format. Notice how the host information and all its open ports are condensed into a single line:
## Nmap 7.80 scan initiated Sat Mar 7 16:07:20 2026 as: nmap -p 22,8080 -oG grepable_scan.txt 127.0.0.1
Host: 127.0.0.1 (localhost) Status: Up
Host: 127.0.0.1 (localhost) Ports: 22/open/tcp//ssh///, 8080/open/tcp//http-proxy///
## Nmap done at Sat Mar 7 16:07:20 2026 -- 1 IP address (1 host up) scanned in 0.02 seconds
This structure makes it incredibly easy to search for specific keywords, such as "open", and extract the corresponding IP addresses, which you will practice in a later step.
Output to XML Format (-oX)
In this step, you will learn how to generate XML output. XML (eXtensible Markup Language) is a highly structured format that is widely supported by many different software applications.
Structured machine-readable output becomes more important as assessments scale. Once your scan results need to move into other tools, ad hoc text parsing becomes fragile and expensive to maintain.
In the context of penetration testing, XML is the preferred format when you need to import your Nmap scan results into other security tools, such as the Metasploit Framework, vulnerability scanners, or custom reporting scripts. To create an XML output file, you use the -oX flag.
Run the following command to perform the scan and save the results as xml_scan.xml:
nmap -p 22,8080 -oX xml_scan.xml 127.0.0.1
You can inspect the contents of the XML file using the cat command:
cat xml_scan.xml
The output will be a large block of structured XML tags. While it is not very easy for humans to read quickly, it is perfectly formatted for machines to parse:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.80 scan initiated Sat Mar 7 16:07:30 2026 as: nmap -p 22,8080 -oX xml_scan.xml 127.0.0.1 -->
<nmaprun scanner="nmap" args="nmap -p 22,8080 -oX xml_scan.xml 127.0.0.1" start="1772870850" startstr="Sat Mar 7 16:07:30 2026" version="7.80" xmloutputversion="1.04">
...
<host starttime="1772870850" endtime="1772870850"><status state="up" reason="conn-refused" reason_ttl="0"/>
<address addr="127.0.0.1" addrtype="ipv4"/>
<hostnames>
<hostname name="localhost" type="PTR"/>
</hostnames>
<ports><port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
...
Parse Grepable Output with Awk
In this final step, you will put the Grepable output format to practical use. A common scenario in penetration testing is scanning a large network, finding hosts with specific open ports, and then extracting just the IP addresses of those hosts to feed into another tool (like a password cracker or a vulnerability exploit).
We will use two powerful Linux text-processing tools: grep and awk. The grep command filters lines containing a specific word, and awk can extract specific columns from those lines.
First, let's look at how we can filter our Grepable file to only show lines that contain the word "open":
grep "open" grepable_scan.txt
This command outputs the line containing the host and its open ports.
Host: 127.0.0.1 (localhost) Ports: 22/open/tcp//ssh///, 8080/open/tcp//http-proxy///
Now, we want to extract just the IP address. In the Grepable format, the IP address is always the second "word" (or column) on the line. We can pipe (|) the output of grep into awk and tell it to print the second column ($2).
Run the following command to extract the IP address and save it into a new file called open_hosts.txt:
grep "open" grepable_scan.txt | awk '{print $2}' > open_hosts.txt
Let's verify the contents of our new file:
cat open_hosts.txt
You should see just the IP address printed out:
127.0.0.1
By mastering this simple command combination, you can quickly parse massive scan files and extract exactly the targets you need for the next phase of your assessment.
Summary
In this lab, you learned how to effectively document and manage Nmap scan results using different output formats. You explored the Normal format (-oN) for human readability, the Grepable format (-oG) for command-line parsing, and the XML format (-oX) for tool integration. Finally, you practiced using Linux text-processing utilities like grep and awk to extract specific target information from Grepable output files. These skills are essential for organizing data and streamlining workflows during security assessments.
