Grepable Format (-oG <logfilename>)
The unix command "grep" is well known for its ability to quickly locate text within a file. The "grep" moniker is an abbreviation for the name "Global Regular Expression Print."

The "grepable" nmap format places the scan summary information and the host scan results onto single lines. This makes it very easy to search for specific information, since the results of a text search would identify a single applicable line of text. This also makes it relatively easy for other programs to query and interact with nmap's output.

An excerpt of a scan's grepable output is listed here, although some of the lines are truncated to fit onto the screen. The nmap operational output lines begin with pound signs (#), and the host scan information line begins with the word "Host:"

# nmap 3.81 scan initiated Sat May 21 09:42:40 2005 as: ./nmap -v -oA subnet0 192.168.0.1/24 
# Ports scanned: TCP(1663;1-1027,1029-1033,1040,1050,1058-1059,1067-1068,1076,1080,1083-1084... 
Host: 192.168.0.0 () Ports: 80/open/tcp//http///  Ignored State: closed (1662)
Host: 192.168.0.1 () Ports: 80/open/tcp//http///  Ignored State: closed (1662)
Host: 192.168.0.3 () Ports: 80/open/tcp//http///, 443/open/tcp//https/// Ignored State: filtered (1661)
Host: 192.168.0.6 () Ports: 80/open/tcp//http///, 443/open/tcp//https/// Ignored State: filtered (1661)
Host: 192.168.0.7 () Ports: 68/open/tcp//dhcpclient///, 6000/open/tcp//X11/// Ignored State: closed (1661)
Host: 192.168.0.99 ()	Ports: 21/open/tcp//ftp///, 23/open/tcp//telnet///, 25/filtered/tcp//smtp///...
Host: 192.168.0.255 ()	Ports: 80/open/tcp//http///	Ignored State: closed (1662)
# Nmap run completed at Sat May 21 09:43:40 2005--256 IP addresses (7 hosts up) scanned in 59.915 seconds
Some scan information will not be available in the grepable output file, and the nmap man page makes it clear that the recommended output format for after-scan interaction is the XML output format (-oX).

clock
Although the XML format is the recommended output format, features such as the --resume option will only operate correctly with the grepable format (-oG) or the normal format (-oN).


The grepable output type was previously called the "machine readable" format (-oM). The -oM option will still work, but the alias has been deprecated and shouldn't be used.

The grepable format is always variable, and there's no guaranteed method of automatically retrieving information from a grepable text file. Simple changes to the scan, such as adding the verbose option (-v), will add variability to the output. If the output will undergo extensive post-scan analysis, a better option is to use the XML output (-oX) option.


All Formats (-oA <basefilename>)
If all of the formats are required, the "all formats" option (-oA) will create three separate output files. The basefilename will be added to files that have an extension of .nmap (normal output), .gnmap (grepable output), and .xml (XML output).

This format is helpful when both the XML output is needed and the --resume option is required. Since --resume only works with normal or grepable output, this "all formats" option covers all circumstances.

clock
Get used to using the "all formats" output option for all of your scans!