If you know perl, you could use the Nmap::Parser::XML module, and go even further (than just filtering) and split all the machines by OS type also. So you can do specific scans to specific OS machine types. That's how I am doing it now. I have a nessusrc.win and a nessusrc.unix. And from my script, I get two lists generated: win.hostlist unix.hostlist. And I pass this info over to nessus. Just an idea.

Regards,

Anthony

-----Original Message-----
From: jcosta@lendleaserei.com [mailto:jcosta@lendleaserei.com]
Sent: Thursday, August 21, 2003 11:33 AM
To: nathan@nathanvalentine.org
Cc: nessus@list.nessus.org; owner-nessus@list.nessus.org
Subject: Re: exclude IP's in scan

I use nmap to scan all the listening IP's in a range and tuck that into a
file called "scan." Then I use awk to grab only the listening IP addresses
in that range into a file called "ip".  Then I use sed to remove a specific
IP I don't want scanned by Nessus, and put balance of the "good" IP's into
a file called "scanhosts.conf" that Nessus uses.

The code is below to steal or improve.

The question is: how do I specify all these hosts on one command line so
that they all show up in one report, and not in single reports for each IP?

nmap -sP -n 192.168.0.1/24 > scan
sleep 1
awk '/192.168.0./ {print $2 }' scan > ips
sleep 1
sed '/192.168.0.253/d' ips > scanhosts.conf

|---------+---------------------------->
|         |           "Nathan R.       |
|         |           Valentine"       |
|         |           <nathan@nathanval|
|         |           entine.org>      |
|         |           Sent by:         |
|         |           owner-nessus@list|
|         |           .nessus.org      |
|         |                            |
|         |                            |
|         |           08/21/2003 12:22 |
|         |           PM               |
|         |                            |
|---------+---------------------------->
  >------------------------------------------------------------------------------------------------------------------------------|
  |                                                                                                                              |
  |       To:       nessus@list.nessus.org                                                                                       |
  |       cc:                                                                                                                    |
  |       Subject:  Re: exclude IP's in scan                                                                                     |
  >------------------------------------------------------------------------------------------------------------------------------|

Feed it a file that has the IP addresses listed one per line. Write a
script to spew out the IP addresses and then remove the ones that you
don't want to scan.

I have some super ugly perl code that will emulate the behavior of the
gping tool mentioned in one of the _Hacking Exposed_ books. Let me know
if you want it and I will send it your way so long as you promise not to
read the code. ;)

--
---
Nathan Valentine - nathan@nathanvalentine.org
http://www.nathanvalentine.org