Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it is not compatible with XML output.

It happens to me very often that a scan will be 99.XX% complete within a reasonable amount of time and then take twice as long to finish that last percent.

Is there a way to have nmap finish the scan and complete the XML output process early? I would like to avoid having to rescan or manually complete the xml file by hand/custom script.

I've tried bringing down the eth0 interface thinking that would make Nmap crash/quit the scan, however that doesn't seem to help at all.

Note: I know that there are flags I can add at the beginning of the scan to lower the timeout and prevent this problem. But this question is more focused on having already started the scan without those flags.

  • If you can give the full commands as well, to minimize guess work. However, you can do a quick "man nmap" and look for "Timing and Performance Section" – Krishna Pandey Nov 25 '15 at 9:23
up vote 14 down vote accepted

Nmap dev here: Sorry, but there is not an option to cleanly stop a scan and finalize the XML output. The --resume option, as you noted, only works with Normal and Grepable output. It also cannot cope with --randomize-hosts. Here are the stages of development we would need to undertake to make this possible:

  1. Extend --resume to parse Nmap's XML output for last completed host. Not too difficult.
  2. Change Nmap's XML output stream to clobber the final tags of a well-formed XML file if --append-output or --resume are started. Tricky, but doable.
  3. Extend Nmap's signal handlers to finalize XML output if any. Difficult because the SIGINT and SIGSTOP signal handlers should be as small as possible and cannot rely on file handles being in a usable state. Maybe make this part of a different signal handler like SIGUSR1 or something and/or bind that to a ctrl key sequence. Also remember that Nmap must work the same on Windows, Linux, OS X, FreeBSD, Solaris, and many other platforms, so signal handling might look very different in those cases.

Feel free to add a feature request to http://issues.nmap.org/new for this, and please reference this question and answer.

EDIT: This was added in Nmap 7.40

Have you tried sending the process a sighup or a sigstop?

something like kill -s STOP [pid] or it is -s SIGSTOP. Can't remember.

  • then the XML won't get created? – schroeder Nov 25 '15 at 5:23
  • it's getting created with whatever output till the time it get killed. I used Ctrl+C to terminate the process. – Krishna Pandey Nov 25 '15 at 9:25

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.