CHAPTER 6: LOGGING OPTIONS
Nmap provides numerous methods of logging the scan output. Nmap's output logs not only save important scan information, they also provide a method of restarting a previously cancelled scan.

In all of the output formats, the filename can be replaced with a hypen (-) to redirect the output to stdout. This can be useful if the output information will be used by another piped process on the same command line.


Normal Format (-oN <logfilename>)
Nmap's normal output format (-oN) saves a similar view of the output that's displayed on the screen during an nmap scan. This readable text is useful when the output is used in a document or printed for later reference.

This saved information is very similar to the run-time output, except for some additional initialization information at the top of the scan:
# nmap 3.81 scan initiated Fri May 20 21:00:50 2005 as: ./nmap -v -sS -oA oA9 192.168.0.9 
Interesting ports on 192.168.0.9:
(The 1654 ports scanned but not shown below are in state: closed)
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
23/tcp   open  telnet
79/tcp   open  finger
110/tcp  open  pop3
111/tcp  open  rpcbind
514/tcp  open  shell
886/tcp  open  unknown
2049/tcp open  nfs
MAC Address: 00:03:47:6D:28:D7 (Intel)

# Nmap run completed at Fri May 20 21:01:01 2005 -- 1 IP address (1 host up) 
  scanned in 10.950 seconds
This output type doesn't follow any particular format. All of the nmap information is jumbled together onto separate lines of output, with a text layout that differs slightly for every scan. This variability makes it difficult for other tools to process the information contained in the output file.

clock
Most of the examples in this book are taken from a normal format output file!