I have a large nmap scan containing a number of logs. I'm trying to turn this into a list of ip's only.When I run my command I receive feedback like the following:Starting Nmap 7.25BETA2 ( https://nmap.org ) at 2017-03-17 21:27 EDTNmap scan report for 10.10.1.22Host is up (0.13s latency).PORT   STATE SERVICE25/tcp open  smtpMAC Address: 00:50:56:89:7C:D5 (VMware)Nmap scan report for 10.0.1.72Host is up (0.22s latency).PORT   STATE SERVICE25/tcp open  smtpMAC Address: 00:50:56:89:55:06 (VMware)I'm trying to retrieve only a list of ip's out of this using the following:nmap -n -p 25 10.11.1.1-254 --open | grep '\d{1,3}\.\d{1,3}\.\d\.\d{1,3}'And I've also tried an awk match:nmap -n -p 25 10.11.1.1-254 --open | awk '/\d{1,3}\.\d{1,3}\.\d\.\d{1,3}/ { print $0 } 'Neither return any results despite being able to see an output when I remove everything to the right of my pipe, and also being able to correctly filter for ip's with the regex in my scratchpad.What piece of knowledge am I missing?
Using regular expressions to parse ip addresses from logs
text processing;awk;regular expression;nmap
You start with using the proper output format for Nmap for this type of thing. Nmap's Grepable output option (-oG) produces output in an easy-to-parse format that is consistent between versions, unlike the human-readable normal output. Here's how to get the list of all systems with port 25 open:nmap -p 25 --open 10.11.1.1-254 -oG - | awk '/^Host/{print $2}'Nmap will produce a line like this:Host: 64.13.134.52 (scanme.nmap.org)    Ports: 25/open/tcp//smtp///And the awk command will match it based on the Host line beginning and print the second field, the IP address.