If I run nmap with the following parameters:
nmap -T4 --top-ports 7500 -Pn -oX output.xml xxx.xxx.xxx.xxx
I get output in the XML file
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///C:/Program Files (x86)/Nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.80 scan initiated Thu May 14 08:39:46 2020 as: nmap -T4 --top-ports 7500 -Pn -oX output.xml xxx.xxx.xxx.xxx -->
<nmaprun scanner="nmap" args="nmap -T4 --top-ports 7500 -Pn -oX output.xml xxx.xxx.xxx.xxx" start="1589470786" startstr="Thu May 14 08:39:46 2020" version="7.80" xmloutputversion="1.04">
<scaninfo type="syn" protocol="tcp" numservices="7500" services="1-35,37-226,228-231,REDACTED-FOR-BREVITIY" />
<verbose level="0" />
<debugging level="0" />
<host starttime="1589470788" endtime="1589470801">
<status state="up" reason="user-set" reason_ttl="0" />
<address addr="xxx.xxx.xxx.xxx" addrtype="ipv4" />
<hostnames />
<ports>
<extraports state="filtered" count="4290">
<extrareasons reason="no-responses" count="4290" />
</extraports>
<extraports state="closed" count="3209">
<extrareasons reason="resets" count="3209" />
</extraports>
<port protocol="tcp" portid="22">
<state state="open" reason="syn-ack" reason_ttl="53" />
<service name="ssh" method="table" conf="3" />
</port>
</ports>
<times srtt="77169" rttvar="3497" to="100000" />
</host>
<runstats>
<finished time="1589470801" timestr="Thu May 14 08:40:01 2020" elapsed="15.07" summary="Nmap done at Thu May 14 08:40:01 2020; 1 IP address (1 host up) scanned in 15.07 seconds" exit="success" />
<hosts up="1" down="0" total="1" />
</runstats>
</nmaprun>
I am trying to determine which 4290 ports are filtered (no-response) and which 3209 are closed (reset).
Is there some combination of nmap flags that can be used to output to XML format, and not to condense the filtered/closed ports?
I wasn't able to find this specified in the documentation: https://nmap.org/book/nping-man-output-options.html
But running the nmap command with a debug level of 3 (-d3) causes nmap to write each port individually to the file. It also writes a ton of debug information to stdout, which is unfortunate in my use case.
nmap -T4 --top-ports 7500 -Pn -d3 -oX output.xml xxx.xxx.xxx.xxx
<ports><port protocol="tcp" portid="1"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="tcpmux" method="table" conf="3"/></port>
<port protocol="tcp" portid="2"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="compressnet" method="table" conf="3"/></port>
<port protocol="tcp" portid="3"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="compressnet" method="table" conf="3"/></port>
<port protocol="tcp" portid="4"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
<port protocol="tcp" portid="5"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rje" method="table" conf="3"/></port>
<port protocol="tcp" portid="6"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>