I was wondering if it was possible to output the result of a nmap scan (>, oN/-oX/-oS/-oG, or an other way) in a way that I would be able to import the results for another nmap scan.

For example, first scan is a ping scan, it outputs the results in a file. Later I decide to do a SYN scan for each of the hosts that was alive (in the first scan). Is there a way for this? Do I have to make a script that would do this task? Thanks

3 Answers 3


Nmap's -iL option will take as input a file with one target specification per line. If you are using -oA or -oG, you can quickly grab this from the grepable output of a prior scan result using awk:

nmap -sn -oA previous
awk '/Status: Up/{print $2}' previous.gnmap > targets.txt
nmap -Pn -iL targets.txt

The same info can be pulled from other output formats, but use the tools that are appropriate and available to you. Also remember that a host's state can change over time, so using -Pn to skip host discovery in the second nmap command above would not be recommended if a day or more elapsed between scans.

  • It says that this output format is deprecated. Does it matter?
    – Bob Ebert
    Apr 12, 2016 at 13:18
  • @BobEbert No, in this case "deprecated" means it won't be extended any more with new features. You can't get NSE script output, traceroute info, MAC address, or CPE identifiers in grepable output; you must use XML output for a machine-readable replacement. But it's not going anywhere because it's a very useful way to script the core features of Nmap. Apr 13, 2016 at 13:00

You will need to run a script to modify the output file to just the IPs in the format that the -iL parameter will accept (spaces between or newlines).

Man page: https://nmap.org/book/man-target-specification.html


Schroeder answered your question to chain/append/add from a previous scan, so I will ask: Is there a specific reason you are solely relying on "ping" for determining whether or not a system is up? Doing so (using ping) can leave you blind to devices that do not respond to ping. I prefer to use arp-scan to determine what is live, and work from there. However, if you want something to do what you'd like, you're better off writing a shell script. If you're running DHCP in your network, chances are there is either more or less.

nmap -sP | awk '/report/{print "nmap -sS -Pn -vvv -oX myoutput.xml "$5}' | sh


  • nmap -sP scan the block
  • grep (using awk) the word report then reprint "nmap -sS -Pn -vvv -oX myoutput.xml against hosts that are alive
  • run

Personally, I don't rely on ping.

  • Thanks for the comment, the ping command was just an example :p
    – Bob Ebert
    Apr 12, 2016 at 21:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .