title: how can I filter nmap results for multiple strings and output to file?
body: <p>2I wanted to get a host list of linux servers on my network using nmap, but I'm not sure how to filter the results based on multiple strings. So I'm using something like:</p>
  
  <pre><code>nmap -sT -R --dns-servers 192.168.1.1,192.168.1.2 -p 22 192.168.1.0/24
  </code></pre>
  
  <p>which gives me the results but of course it's also showing every IP with the closed ports. How can I use logic with awk so that if it finds an IP with a hostname AND finds that the lines below have 'tcp open' it will spit those two lines to an output file? </p>
  
  <p>The typical input to use from nmap would look like:</p>
  
  <pre><code>Interesting ports on server.domain.com (192.168.1.1):
  PORT   STATE SERVICE
  22/tcp open  ssh
  
  Interesting ports on server2.domain.com (192.168.1.2):
  PORT   STATE SERVICE
  22/tcp closed  ssh
  </code></pre>
  
  <p>but this would be for every single IP that is scanned, so I'm trying to find a way to have a file with only the hostname and IP "if" it shows as 'tcp open' from the nmap command above. Basically giving you a file with:</p>
  
  <pre><code>server.domain.com (192.168.1.1)
  </code></pre>
  
  <p>So that I only get the server name and IP if SSH is actually listening on port 22</p>