Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

How it works...

Ndiff is a tool for comparing two Nmap scans. Think about the traditional diff but for Nmap scan reports. With some help from bash and cron, we set up a task that is executed at regular intervals to scan our network and compare our current state with an older state, to identify the differences between them. We used some basic bash scripting to execute our monitoring scan and then executed Ndiff to compare the results:

  if [ $(cat $NDIFF_RESULTS | wc -l) -gt 0 ]    then      echo "Network changes detected in $NETWORK"      cat $NDIFF_RESULTS      echo "Alerting admin $ADMIN"      mail -s "Network changes detected in $NETWORK" $ADMIN < $NDIFF_RESULTS    fi