Gnmap-Parser Revamped

Gnmap-Parser turns one or more Nmap greppable (.gnmap) scan files into small, analysis-friendly host lists, port lists, per-port files, and service matrices. This repository is a modernized continuation of Michael Wright's original Gnmap-Parser, whose simple output layout remains useful in penetration-testing and network-inventory workflows.

Why a revamped version?

The original Gnmap-Parser established a practical workflow: give it Nmap greppable output and receive focused lists that can be passed directly to other command-line tools. That core idea still works well, so this revamp preserves the recognizable command and legacy output filenames instead of replacing the project with a dependency-heavy rewrite.

The original Bash implementation had not been updated since 2013 and carried assumptions that no longer fit many current workflows. In particular, timestamp-prefixed Nmap records could leak into parsed results, matrices could accumulate duplicate rows across runs, input files had to be gathered into the working directory, paths were not safely quoted, sorting assumed IPv4, and recursive discovery errors could silently produce incomplete output.

Gnmap-Parser Revamped addresses those problems while keeping the tool small, auditable, portable, and compatible with existing usage wherever practical. It is intended as a respectful continuation of the original project—not a claim of original authorship.

Nmap has deprecated greppable output in favor of XML. This project remains useful for existing workflows and archives that produce .gnmap files.

What changed in v4

• No timestamps or scan metadata are included in generated files.
• Inputs may be files or directories, and directories are searched recursively.
• Paths containing spaces are supported.
• Repeated runs are idempotent; matrices no longer accumulate duplicate rows.
• Legacy port files and matrices deduplicate endpoints even when scans disagree about the detected service; the CSV retains each distinct service result.
• IPv4, IPv6, and hostnames are preserved with deterministic sorting.
• Only exact open TCP/UDP states are included (open|filtered is excluded).
• Existing v3 filenames remain available, with a correctly named Alive-Hosts-Up.txt added alongside the legacy ICMP filename.
• Open-Services.csv adds a header and detected service names.
• Gather mode refuses to silently overwrite same-named scans.
• Clear exit codes and non-interactive command-line options make automation easy.

Requirements

• Bash 3.2 or newer
• Standard Unix tools: awk, find, sort, cp, and cmp

It works on current macOS and Linux without third-party packages.

Usage

Parse every .gnmap file below the current directory:

./Gnmap-Parser.sh --parse

Parse specific files or directories and choose an output location:

./Gnmap-Parser.sh --parse scans/ office-scan.gnmap --output results

The original short parse switch still works:

./Gnmap-Parser.sh -p

Gather scans into a directory without parsing them:

./Gnmap-Parser.sh --gather archived-scans --output gathered

Run ./Gnmap-Parser.sh --help for all options.

Output

Gnmap-Parser/
├── Host-Lists/
│   ├── Alive-Hosts-Up.txt
│   ├── Alive-Hosts-ICMP.txt        # v3 compatibility alias
│   └── Alive-Hosts-Open-Ports.txt
├── Port-Lists/
│   ├── TCP-Ports-List.txt
│   └── UDP-Ports-List.txt
├── Port-Files/
│   └── Port-<port>-<TCP|UDP>.txt
└── Port-Matrix/
    ├── TCP-Services-Matrix.txt     # port,protocol,host
    ├── UDP-Services-Matrix.txt
    └── Open-Services.csv           # host,port,protocol,service

Host lists come from Nmap Host: records. Alive-Hosts-Up.txt represents records containing Status: Up; Nmap may determine that state by means other than ICMP. The older Alive-Hosts-ICMP.txt name is retained only so existing scripts do not break.

Each parse replaces the four generated subdirectories in the selected output directory. Keep hand-written files elsewhere.

Scan inputs and generated host, port, and service inventories can identify client systems. The parser applies umask 077, creating output directories and files for the invoking user only. Preserve those permissions when copying data, and never commit real assessment inputs or generated output. The repository ignores *.gnmap plus the common Gnmap-Parser/, results/, and gathered/ output directories as an additional guard against accidental publication.

Testing

./tests/test.sh

Original project, license, and attribution

Gnmap-Parser was originally created by Michael Wright and published at jasonjfrank/gnmap-parser. The original Git history is retained so its development and authorship remain visible.

This revamped version is distributed under GPL-3.0-or-later, consistent with the original project. The original copyright notice and complete license are preserved in COPYING.

Responsible use and disclaimer

Process scan data only when you are authorized to possess and use it. You are responsible for protecting potentially sensitive target information and for complying with applicable laws, contracts, and assessment rules.

This program is provided without warranty, and liability is limited to the fullest extent permitted by applicable law. See sections 15 through 17 of the GNU General Public License v3 for the complete warranty and liability terms. This usage notice does not modify or restrict the license.