Nmap -oa Output All Formats Official Docs
You save scan data in three file types using the nmap oa output all formats official docs option. You give the tool one base name, and it writes normal, XML, and grepable files. Security teams use this workflow so they do not have to run the same scan twice. Still, running network scans often requires broad system roles and root permissions on shared hosts. Broad host roles let any logged-in user run wide scans or read old scan files. How the nmap oa output all formats official docs workflow o
LLM Output Filtering: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You save scan data in three file types using the nmap oa output all formats official docs option. You give the tool one base name, and it writes normal, XML, and grepable files. Security teams use this workflow so they do not have to run the same scan twice. Still, running network scans often requires broad system roles and root permissions on shared hosts. Broad host roles let any logged-in user run wide scans or read old scan files.
How the nmap oa output all formats official docs workflow operates
The tool groups three standard file writers into one single step during a network scan. When you start a scan with the all-formats setting, you pick a base file name. The scanner then creates three separate files in your current folder using that base name. Each file gets its own extension to show how the data inside is structured.
First, the normal file saves the human-readable view that you usually see on your screen. It lists open ports, service names, and timing details in a clean table layout. Engineers read this file when they want a quick look at a single host.
Second, the XML file stores the exact same scan results inside structured tags. Other security apps and scripts read this structured file to import host data into databases. You can also turn this file into a web page report for your team.
Third, the grepable file puts each scanned host onto a single long text line. Command line text tools can search and filter these lines in just a few seconds. Having all three files ready at once saves time when an incident happens.
What native file output solves and the gap it leaves
Writing all three formats at once solves a major data problem for security engineers. If you forget to save structured output during a long scan, you lose hours. By saving every format from the start, your team has data for any tool. One engineer can read the text file while another loads the XML into an app.
Still, the native tool only controls how scan results land on the local disk. It does not control who can run the scanner or what networks they can hit. Most deep network scans need elevated system permissions to send raw packets over the wire. Teams often grant broad admin roles on a shared server so engineers can run scans.
LLM Output Filtering: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Once an engineer logs in with that broad role, the operating system steps back. Host permissions decide who logs in, not what individual commands do in flight. Anyone with shell access can scan restricted subnets or overwrite old report files on disk. Also, raw scan outputs might capture sensitive banner text like internal emails or phone numbers. Without runtime checks on commands, teams must trust every manual action on that shared host.
Managing scan logs and host roles in team workflows
To keep scan data tidy, teams set up clear naming rules for their base files. Putting the date and target subnet in the base name helps everyone find old reports. Engineers also move finished files off the scanner host and into central storage right away. This habit keeps local disks clean and stops one user from overwriting another user's work.
Even with good file habits, shared scanner hosts need strict oversight for every command run. Teams want to know who started a scan, when it ran, and which targets it touched. Relying on local shell history files fails when multiple people share the same root role.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
What are the three file types created by the all-formats option?
The scanner writes a normal text file, an XML document, and a grepable text file. All three files share the base name you pick and sit in the same folder.
Why does the official documentation skip the script kiddie format?
The all-formats setting leaves out the fourth joke format because it serves no operational use. Teams only need normal, XML, and grepable files for real reading, parsing, and reporting tasks.
What happens if I run a new scan with an existing base file name?
By default, the scanner overwrites the old normal, XML, and grepable files with new data. You must pick a new base name or turn on append mode to keep old logs.