# Nmap Output Parser

Parse nmap XML or greppable output into sortable host, port, service and version tables. Export Markdown, CSV or JSON.

## Run it

- **CLI:** `gizza tool nmap-output-parser '<?xml version="1.0"?>
<nmaprun>...'`
- **Web:** https://gizza.ai/tools/nmap-output-parser/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/nmap-output-parser/tool.json

## Inputs

- `input` — Nmap output _(field)_
- `format` — Input format _(field)_
- `output` — Output _(field)_
- `sort_by` — Sort by _(field)_
- `open_only` — Open ports only _(field)_

## Output

- Parsed table (text)

## Query parameters

Open the tool pre-filled and auto-run via URL:

- `input` — Nmap output
- `format` — Input format
- `output` — Output
- `sort_by` — Sort by
- `open_only` — Open ports only

Example: `https://gizza.ai/tools/nmap-output-parser/?input=%3C%3Fxml%20version%3D%221.0%22%3F%3E%0A%3Cnmaprun%3E...&format=auto&output=markdown&sort_by=host&open_only=true`

---

## About this tool

**Nmap Output Parser** converts raw nmap scan output into a table you can sort, copy, diff or feed into a report. It understands the two nmap formats most often saved from automated scans:

- XML from `nmap -oX scan.xml`
- Greppable text from `nmap -oG scan.gnmap`

The parser extracts the host, hostname, port, protocol, state, service name and detected version string. By default it keeps only open ports so the result is report-ready, but you can turn **Open ports only** off to include closed and filtered rows too.

### Worked example

Input:

```xml
<nmaprun>
  <host>
    <address addr="10.0.0.10" addrtype="ipv4"/>
    <hostnames><hostname name="web.local"/></hostnames>
    <ports>
      <port protocol="tcp" portid="80">
        <state state="open"/>
        <service name="http" product="nginx" version="1.18.0"/>
      </port>
    </ports>
  </host>
</nmaprun>
```

Output as Markdown:

```markdown
| Host       | Hostname  | Port | Protocol | State | Service | Version      |
| ---------- | --------- | ---- | -------- | ----- | ------- | ------------ |
| 10.0.0.10 | web.local | 80   | tcp      | open  | http    | nginx 1.18.0 |
```

### Options

- **Input format** — auto-detect, XML (`-oX`) or greppable (`-oG`).
- **Output** — Markdown table, CSV or JSON.
- **Sort by** — host, port or service. IPv4 hosts sort numerically, so `10.0.0.9` comes before `10.0.0.10`.
- **Open ports only** — enabled by default; disable it to include closed or filtered ports.

## FAQ

<details>
<summary>Does this run nmap for me?</summary>

No. It parses output you already have. Run nmap separately and paste XML from `nmap -oX` or greppable output from `nmap -oG`.

</details>

<details>
<summary>Which nmap output format should I use?</summary>

XML (`-oX`) is the most structured and preserves service/version details reliably. Greppable (`-oG`) is convenient for older scripts and quick scans, and this tool can parse its `Host:` / `Ports:` records too.

</details>

<details>
<summary>Why did closed ports disappear?</summary>

**Open ports only** is on by default because most reports focus on reachable services. Turn it off to include `closed`, `filtered` and other states found in the scan.

</details>

<details>
<summary>Does it parse UDP and IPv6 scans?</summary>

Yes. Protocols such as `tcp` and `udp` are preserved from the nmap output, and IPv6 host strings are kept. IPv4 hosts get numeric sorting; IPv6 and names sort as strings.

</details>

## Related tools

- [Basic Auth Header Generator](https://gizza.ai/tools/basic-auth-header-generator/): Generate an HTTP Basic Authorization header from a username and password — base64(user:pass) per RFC 7617. Runs in your browser, nothing is sent, free.
- [Calendar Free/Busy Overlap](https://gizza.ai/tools/calendar-freebusy-overlap/): Paste two .ics calendars and list the time slots where both are free — working hours, minimum meeting length, timezones and DST handled. Free and in-browser.
- [CIDR Calculator](https://gizza.ai/tools/cidr-calculator/): CIDR calculator: get network address, broadcast, netmask, wildcard, usable host range and host count for any IPv4 or IPv6 prefix. Free, private, in-browser.
- [Extract Emails & Phone Numbers from Text](https://gizza.ai/tools/contact-info-extractor/): Extract emails and phone numbers from pasted text. Deduplicated, counted, sorted, and private in your browser with no upload.
- [cURL Command Parser](https://gizza.ai/tools/curl-command-parser/): Paste a curl command to see its method, URL, query params, headers, body, auth, cookies and flags — or rebuild clean curl. Browser-only.