VMware ESXi and vSphere Cluster Management

Save and Export Nmap Scan Output

Learn how to save Nmap results as normal, XML, grepable, or combined files, inspect saved reports, and use safe naming for authorized assessments.

Nmap output is the scan results and scan metadata that Nmap displays in the terminal or writes to files. Saving that output preserves evidence after a terminal session ends, lets you review findings without rerunning the scan, and supports reporting, comparison, automation, and import workflows.

Run scans only against systems you own or are explicitly authorized to assess. Treat saved scan results as potentially sensitive security assessment artifacts.

Why save Nmap output?

• Preserve findings: A saved file remains available after the terminal closes or scrollback is lost.
• Review later: You can inspect the report without consuming time or generating another scan.
• Support reporting: Normal output is convenient for notes, evidence, and sharing with a teammate.
• Enable automation: XML can be parsed, transformed, imported, or used to generate reports.
• Compare scans: Date-specific files make it easier to identify changes between authorized assessment runs.

Choose the format based on its consumer: people generally prefer normal output, while software usually benefits from XML. Grepable output can help with simple command-line filtering, but it is a legacy format.

Nmap output option syntax

Nmap output options take a destination filename or path as their argument. The option is placed with the other scan options, followed by the target.

nmap [scan options] -oN output-file target

For example:

nmap -p 21,22,80,135 -oN scan-results.nmap 192.168.5.102

The output option selects the format. The filename extension is only a naming convention; changing .xml to .txt does not turn normal output into XML. Use -oN, -oX, -oG, or -oA deliberately.

Use writable paths and descriptive names. Reusing an output filename or -oA basename can replace an earlier report, so check for existing files before launching another scan.

Nmap output formats at a glance

Save normal output with -oN

Normal output is Nmap's standard human-readable report. It normally includes scan metadata, target and host status, port states, service information, and final statistics in a form intended for people.

nmap -p 21,22,80,135 -oN scan-results.nmap 192.168.5.102

In this example, -p 21,22,80,135 selects four ports, -oN selects normal output, and scan-results.nmap is the destination file. The extension is conventional; -oN is what selects the format.

View the saved report from the shell:

cat scan-results.nmap

For a longer report, use a pager:

less scan-results.nmap

Normal output is appropriate for manual review, sharing with a teammate, and attaching readable scan evidence to assessment notes.

Save structured XML output with -oX

XML is a structured markup format suitable for machine-readable workflows. Nmap XML can be parsed by software, transformed into another format, used to generate reports, or imported into compatible tools and databases.

nmap -p 21,22,80,135 -oX scan-results.xml 192.168.5.102

Major categories represented in XML include:

• Scan arguments and Nmap version metadata
• Hosts, addresses, and hostnames
• Host availability and status
• Ports and their states
• Detected service names and related service information
• Timing data
• Run start, completion, and final statistics

Raw XML is not intended to be as convenient for manual reading as normal output. Use an XML-aware viewer or parser, or apply an approved stylesheet or transformation workflow to produce browser-friendly or HTML-style output. You do not need to manually parse every XML element to benefit from the format.

Save grepable output with -oG

Grepable output is a line-oriented format designed for filtering with Unix text-processing tools. Save it with -oG:

nmap -p 21,22,80,135 -oG scan-results.gnmap 192.168.5.102

At a conceptual level, a host record identifies the host status and may include a Ports: field containing comma-separated port entries. Those entries describe information such as port number, state, protocol, and service.

A simple filter for records containing open ports is:

grep 'Ports:.*open' scan-results.gnmap

Validate filters against representative scan data. Grepable output is a legacy format, and assumptions about field layout can make scripts unreliable. For new automated workflows, prefer XML and an XML parser when possible.

Save all major formats with -oA

The -oA option writes normal, XML, and grepable output from one scan. It takes a shared basename, meaning the filename prefix before Nmap appends format-specific extensions.

nmap -p 21,22,80,135 -oA assessment-2026-08-18 192.168.5.102

This creates:

• assessment-2026-08-18.nmap — normal readable output
• assessment-2026-08-18.xml — structured XML output
• assessment-2026-08-18.gnmap — grepable output

Use -oA when you want a readable report together with machine-readable data and a legacy text-processing artifact.

Store results in a dedicated directory

Separate assessment artifacts from unrelated files. This makes permissions, cleanup, review, and repeatable naming easier.

mkdir -p nmap-results && nmap -p 21,22,80,135 -oA nmap-results/host-192.168.5.102-ports 192.168.5.102

The current user must have permission to create the directory and write the output files. A useful filename can identify the authorized scope, scan type, and date or run identifier, such as host-192.168.5.102-ports-2026-08-18.

Protect scan results with appropriate filesystem permissions and approved storage practices. Reports can reveal reachable hosts, open services, addresses, and assessment details.

Reading and interpreting saved output

Saved normal output contains the same essential findings that appeared in the terminal. Look for the target summary, scan start information, host availability, the port table, service labels, completion information, and elapsed time.

Understanding port states and service labels

A port state is Nmap's classification of a scanned port. Open means an application is listening and responding on that port. Closed means the host is reachable but no application is listening there. Other states can occur depending on filtering and scan conditions, so interpret the state in the context of the scan options.

A service detection label is the service name Nmap associates with a port. Common labels include ftp for FTP, ssh for SSH, http for HTTP, and msrpc for Microsoft RPC. A label is scan output, not by itself a complete security conclusion.

Also review scan metadata: the Nmap version, command arguments, scan start and completion times, target summary, and elapsed time. These details help explain what the results do and do not represent.

Repeatable naming and safe file handling

1. Create a dedicated directory for each assessment or approved project.
2. Include the authorized target scope, scan type, and date or run identifier in the basename.
3. Check whether the destination file already exists before starting the scan.
4. Use a new basename for each meaningful run instead of overwriting prior findings.
5. Restrict access and store results only in approved locations.

For example, a basename such as lab-web-192.168.5.102-tcp-selected-2026-08-18 is more useful than a generic name such as results.

Troubleshooting saved output

No output file appears

Check the working directory and destination:

pwd
ls

The path may be mistyped, the command may have run from a different directory, or the account may lack write permission. Specify an explicit writable path and confirm filesystem permissions before rerunning.

The file has the wrong format

Remember that the Nmap option, not the extension, selects the format. Use -oN for normal output, -oX for XML, -oG for grepable output, or -oA for all three.

An earlier report was replaced

The same output filename or -oA basename was reused. Adopt unique names containing a date, run identifier, or scan description, and inspect the destination directory before each scan.

XML is difficult to read in a terminal

That is expected: XML is structured primarily for software. Save normal output as well with -oA, or use an XML-aware viewer, parser, or approved transformation workflow.

A grep-based parser is unreliable

Grepable output is a legacy convenience format, and fixed-field assumptions may fail under different scan conditions. Prefer XML for durable automation and test any parser against representative results.

Quick reference

# Normal readable report
nmap -p 21,22,80,135 -oN scan-results.nmap 192.168.5.102

# Structured XML report
nmap -p 21,22,80,135 -oX scan-results.xml 192.168.5.102

# Legacy grepable report
nmap -p 21,22,80,135 -oG scan-results.gnmap 192.168.5.102

# All three formats
nmap -p 21,22,80,135 -oA assessment-2026-08-18 192.168.5.102

For a concise decision rule: use -oN for people, -oX for structured processing, -oG for simple legacy filtering, and -oA when you need all three representations from one authorized scan.

See also: Save Nmap scan output.