The output from my nmap script for gleaning hostname, ASN, CIDR and country
code from a list of IP addresses
generally looks like this:
Nmap scan report for 2a00:1298:8011:212::165
Host is up.
Host script results:
| asn-query:
| BGP: 2a00:1298::/32 | Country: SK
|_ Origin AS: 5578 - AS-BENESTRA Bratislava, Slovak Republic, SK
Nmap scan report for 2a00:1370:8110:3eea:ddea:8b70:415a:f33e
Host is up.
Host script results:
|_asn-query: See the result for 2a00:1370:8114:b2d1:45ee:f77e:facb:d2e8
Nmap scan report for 2a00:1370:8110:79d7:2821:a9b2:9315:cb0f
Host is up.
Host script results:
|_asn-query: See the result for 2a00:1370:8114:b2d1:45ee:f77e:facb:d2e8
I'm using the following grep script to separate the desired data:
grep -e "Nmap scan report for" -e "BGP:" -e "Origin AS:" -e "asn-query: See
the result for" SS.IPv6-HN-GLU-MB-Domains-January2020-Uniq-nMap.txt >
SS.IPv6-HN-GLU-MB-Domains-January2020-Resolve.txt
Which [nearly instantly] produces results that look like this (after
stripping a few (9000+) carriage returns with Leafpad:
Nmap scan report for 2a00:1298:8011:212::165 2a00:1298::/32 | Country: SK
AS5578 - AS-BENESTRA Bratislava, Slovak Republic, SK
Nmap scan report for 2a00:1370:8110:3eea:ddea:8b70:415a:f33e
|_asn-query: See the result for 2a00:1370:8114:b2d1:45ee:f77e:facb:d2e8
Nmap scan report for 2a00:1370:8110:79d7:2821:a9b2:9315:cb0f
|_asn-query: See the result for 2a00:1370:8114:b2d1:45ee:f77e:facb:d2e8
I can remove "|_asn-query:" with sed:
sed 's/|_asn-query://g' SS.IPv6-HN-GLU-MB-Domains-January2020-ResolvePart.txt
> SS.IPv6-HN-GLU-MB-Domains-January2020-ResolveStep01.txt
With the following general result:
Nmap scan report for 2a00:1298:8011:212::165 2a00:1298::/32 | Country: SK
AS5578 - AS-BENESTRA Bratislava, Slovak Republic, SK
Nmap scan report for 2a00:1370:8110:3eea:ddea:8b70:415a:f33e
See the result for 2a00:1370:8114:b2d1:45ee:f77e:facb:d2e8
Nmap scan report for 2a00:1370:8110:79d7:2821:a9b2:9315:cb0f
See the result for 2a00:1370:8114:b2d1:45ee:f77e:facb:d2e8
Replacing the carriage return in the string "f33e [C.R.] See the result for"
with a tab and just "See"
is proving problematic. In Leafpad, it will take way too long (days ...) so
I'm forced to learn some
more scripting tricks ... I need to do this without inadvertently stripping
all 400,000 carriage returns.
George Langford
