11

Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it is not compatible with XML output.

It happens to me very often that a scan will be 99.XX% complete within a reasonable amount of time and then take twice as long to finish that last percent.

Is there a way to have nmap finish the scan and complete the XML output process early? I would like to avoid having to rescan or manually complete the xml file by hand/custom script.

I've tried bringing down the eth0 interface thinking that would make Nmap crash/quit the scan, however that doesn't seem to help at all.

Note: I know that there are flags I can add at the beginning of the scan to lower the timeout and prevent this problem. But this question is more focused on having already started the scan without those flags.

Improve this question
1
  • If you can give the full commands as well, to minimize guess work. However, you can do a quick "man nmap" and look for "Timing and Performance Section"
    – Krishna Pandey
    Nov 25, 2015 at 9:23

2 Answers 2

Reset to default
18

Nmap dev here: Sorry, but there is not an option to cleanly stop a scan and finalize the XML output. The --resume option, as you noted, only works with Normal and Grepable output. It also cannot cope with --randomize-hosts. Here are the stages of development we would need to undertake to make this possible:

  1. Extend --resume to parse Nmap's XML output for last completed host. Not too difficult.
  2. Change Nmap's XML output stream to clobber the final tags of a well-formed XML file if --append-output or --resume are started. Tricky, but doable.
  3. Extend Nmap's signal handlers to finalize XML output if any. Difficult because the SIGINT and SIGTSTP signal handlers should be as small as possible and cannot rely on file handles being in a usable state. Maybe make this part of a different signal handler like SIGUSR1 or something and/or bind that to a ctrl key sequence. Also remember that Nmap must work the same on Windows, Linux, OS X, FreeBSD, Solaris, and many other platforms, so signal handling might look very different in those cases.

Feel free to add a feature request to http://issues.nmap.org/new for this, and please reference this question and answer.

UPDATE: Resuming was added in Nmap 7.40 (but not finalizing (closing open XML tags) with an interrupt signal or similar):

Added scan resume from Nmap's XML output. Now you can --resume a canceled scan from all 3 major output formats

Improve this answer
0
-1

Have you tried sending the process a sighup or a sigstop?

something like kill -s STOP [pid] or -s SIGSTOP

Improve this answer
2
  • 1
    then the XML won't get created?
    – schroeder ♦
    Nov 25, 2015 at 5:23
  • it's getting created with whatever output till the time it get killed. I used Ctrl+C to terminate the process.
    – Krishna Pandey
    Nov 25, 2015 at 9:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .