Nmap output formats explained: -oN, -oX, -oG, and -oA

Four formats, four audiences

Normal output (-oN) is what you see in the terminal, saved to a file. It is best for humans and for pasting into notes. XML output (-oX) holds everything Nmap knows, including script results, timing, and the command line, in a structured form that other tools import. Grepable output (-oG) puts each host on one line for quick grep, awk, and cut pipelines, but it is deprecated and omits script output.

-oA basename writes all three at once as basename.nmap, basename.xml, and basename.gnmap. Make it the default for any scan you might need again.

Why XML is the one to keep

XML is the format reporting tools, vulnerability platforms, and your own scripts should read. It records the exact Nmap version and arguments in the nmaprun element and every port with state, reason, and service attributes. You can convert it to an HTML report with xsltproc and the stylesheet that ships with Nmap.

Normal output can change wording between versions. Do not build parsers on it.

Snippet

sudo nmap -sV -oA lab-2026-11-02 192.168.56.0/24
xsltproc lab-2026-11-02.xml -o lab-2026-11-02.html

Lab: resume and extract

Start a slow scan with -oA, interrupt it with Ctrl-C partway, then run nmap --resume lab.gnmap. Nmap reads the saved state and continues from the last completed host. That only works with normal or grepable output saved during the original run.

Then pull a quick list of hosts with port 22 open from the grepable file, and the same list from XML with a short xmllint query, to see both approaches.

Snippet

sudo nmap -sV -oA lab 192.168.56.0/24   # press Ctrl-C midway
sudo nmap --resume lab.gnmap
grep "22/open" lab.gnmap | awk '{print $2}'
xmllint --xpath '//host[ports/port[@portid="22"]/state/@state="open"]/address[@addrtype="ipv4"]/@addr' lab.xml

Storing scan files

Scan files reveal your network’s layout and weak spots. Store them with the same care as other sensitive engagement data: access-controlled, encrypted at rest, and deleted on the schedule the scope or policy sets.

Name files with the date and scope, like dmz-2026-11-02. Consistent names make the comparison tutorial that follows much easier.

Diagram

Which output file to open

Save all three with -oA, then use the one that fits.

.nmap (normal)
Human reading and notes. Do not parse.
.xml
Complete record. Import into tools and scripts.
.gnmap (grepable)
One line per host for quick shell filters; no script output; deprecated.

Check yourself

1. Which option saves normal, XML, and grepable output together?

2. Which format should a custom parser read?

3. What is missing from grepable output?