Nmap online course

Save Nmap Scan Output in Normal, XML, Grepable, and All Formats

Learn how to save Nmap results with -oN, -oX, -oG, and -oA, inspect saved files, choose formats, and protect scan artifacts.

Nmap normally prints scan findings in the terminal. Terminal output is temporary: it can scroll away, be difficult to share, and cannot reliably support later comparison or automation. Saving the result creates a durable record for reporting, evidence collection, comparison over time, later analysis, and scripts.

Use these commands only on systems and networks for which you have authorization. A saved result can contain sensitive network inventory information, so treat it as a controlled artifact.

What Nmap records

An Nmap output file contains findings and scan metadata. Scan metadata is the context needed to understand how the result was produced. Depending on the scan, a saved result can include the Nmap version, command invocation and options, timestamps, target information, host state, addresses, port and protocol details, port states, service detection labels, timing information, and final run statistics.

A port state is Nmap's classification of a port, such as open or closed. A service detection label is the service name Nmap associates with a port based on the available scan information. Run statistics summarize items such as hosts scanned, elapsed time, and execution outcome.

Output flags and filenames

Nmap output options are separate flags followed by a destination filename or basename. The output filename is independent of the target argument. In other words, the target tells Nmap what to scan, while the output argument tells it where to save the result.

nmap -oN <output-file> <target>
nmap -oX <output-file.xml> <target>
nmap -oG <output-file.gnmap> <target>
nmap -oA <output-basename> <target>

Extensions are conventions rather than the mechanism that selects the format. Match the extension to the selected format so people and tools can identify the file easily. Nmap can write one format or several formats during one scan.

Normal output with -oN

Normal output is Nmap's readable, text-oriented report format. It resembles the report printed in a command-line session and is useful for manual review, sharing a simple report, or retaining a familiar record of a scan.

nmap -p 21,22,80,135 -oN results.txt 192.168.5.102

The resulting file can contain the scan invocation, host availability, a port table with protocol and port state, detected service names, and scan completion information. For example, look for lines that identify the target and host state, then inspect the port table for open and closed states.

less results.txt

less lets you review a long report without printing the entire file at once. Use normal output when a person is the primary reader, but do not depend on its wording as a stable data interface for a new program.

XML output with -oX

XML output is a structured, machine-readable representation of the scan. It is appropriate for XML parsers, reporting pipelines, databases, scan-result management systems, and transformations into presentation formats.

nmap -p 21,22,80,135 -oX results.xml 192.168.5.102

Recognize these major concepts in an XML result:

• Scan-level metadata: invocation, Nmap version, start time, options, and scan type.
• Host elements: each discovered target, including its address and status.
• Ports: port number, protocol, and port state such as open or closed.
• Service data: a service name and, when available, product or version details.
• Timing data: timing and performance information recorded for the scan or host.
• Final run statistics: host counts, elapsed time, and completion information.

<host>
  <status state="up" />
  <address addr="192.168.5.102" addrtype="ipv4" />
  <ports>
    <port protocol="tcp" portid="80">
      <state state="open" />
      <service name="http" />
    </port>
  </ports>
</host>

The example is an abbreviated illustration. In a real file, the surrounding scan metadata and closing run-statistics elements provide the context needed to interpret the host data. An XML stylesheet reference may allow browser viewing when the referenced Nmap stylesheet is available. Treat XML primarily as structured data, not as a browser report.

Grepable output with -oG

Grepable output is a line-oriented text format designed for simple command-line filtering and older text-processing workflows. Conceptually, a host record includes the host status and a compact, comma-separated list of port entries. Those entries can include the port, protocol, state, and service information.

nmap -p 21,22,80,135 -oG results.gnmap 192.168.5.102
grep 'Ports:' results.gnmap

This format can be convenient when a quick filter is enough, but it is retained mainly for compatibility and is deprecated. New automation should generate XML with -oX or -oA and use an XML-aware parser. A parser can handle nested data, missing fields, multiple hosts, port states, and service attributes more reliably than fragile string splitting.

Save all major formats with -oA

The -oA option takes a basename, meaning a common filename prefix. Nmap adds the conventional suffix for each major format:

nmap -p 21,22,80,135 -oA scans/host-192.168.5.102-tcp 192.168.5.102

This command creates:

• scans/host-192.168.5.102-tcp.nmap for normal output.
• scans/host-192.168.5.102-tcp.xml for XML output.
• scans/host-192.168.5.102-tcp.gnmap for grepable output.

Using -oA is useful when one execution must serve several purposes: a person can read the normal report, an application can import the XML, and an older workflow can use the grepable file. You do not need to rerun the scan merely to obtain another of these formats.

Reading and validating saved results

Start by checking the file and its location:

ls -l scans/
less scans/host-192.168.5.102-tcp.nmap
cat scans/host-192.168.5.102-tcp.gnmap
grep 'Ports:' scans/host-192.168.5.102-tcp.gnmap

In normal output, inspect the port table and identify the state column. An open port indicates that an application accepted the probe; a closed port indicates that the host was reachable but no application was listening on that port. In XML, find a port element and inspect its nested state element, for example state="open" or state="closed".

Do not validate a result only by looking for an individual port. Confirm the target identity, host reachability, requested ports, scan options, start time, finish information, and final run statistics. The command and finish summary help establish which target, ports, and options produced the file.

Safe operational workflow

1. Confirm that the target is within your authorized scope.
2. Create the destination directory before scanning, for example mkdir -p scans.
3. Choose a meaningful name containing the target, scan purpose, and date or run identifier, such as host-192.168.5.102-tcp-2026-08-18.
4. Verify the destination path and whether a file with that name already exists.
5. Choose -oN for people, -oX for new tooling, or -oA when you need all three main formats.
6. Review the saved result and protect the directory with permissions appropriate to potentially sensitive inventory data.

Troubleshooting saved output

No output file appears

• The command may have run from a different working directory. Use an explicit absolute or clearly verified relative path.
• The destination directory may not exist. Create it before the scan.
• The directory may not be writable. Check permissions and use only the privileges needed.

The format or extension is unexpected

• Match -oN with normal text, -oX with XML, and -oG with grepable output.
• With -oA, provide a prefix rather than a complete filename extension, then look for .nmap, .xml, and .gnmap.

A prior result was lost

A reused filename may have replaced an older file. Use a naming convention based on target, scan type, and date or run identifier, and confirm that the destination is not already in use.

A script cannot reliably consume grepable output

Grepable output is a deprecated legacy interface, and scripts that split lines or commas can break when fields vary. Generate XML with -oX or -oA and use an XML parser that handles hosts, ports, states, services, and missing fields structurally.

XML does not look formatted in a browser

The XML may reference an Nmap XSL stylesheet that is unavailable from the current system or path. Treat the file as XML data and open it with an XML-capable tool or parser. If an HTML-style presentation is required, use an available stylesheet or another transformation workflow.

Choosing a format

• Choose -oN when a person needs a straightforward report.
• Choose -oX when software, a database, or a reporting pipeline will consume the result.
• Choose -oG only for compatibility or a simple legacy text filter.
• Choose -oA when you want normal, XML, and grepable files from one authorized scan.

For background on interpreting Nmap scan results, review how host and port findings are presented. You can also learn about specifying port ranges, service and version detection, and Nmap port states.