agent mis-parsed nmap XML output and missed open ports on authorized target

Not specified by the original author.

TL;DR

Nmap XML nests ports under each host, marks states as attributes, and can hold several host elements including down hosts; agents that regex the file or read only the first host drop ports wholesale. Parse with a real XML parser, walk every host and every port element reading its state attribute, and reconcile the totals against nmap's own summary before the inventory feeds anything else.

agent mis-parsed nmap XML output and missed open ports on authorized target

Use this when

• The agent's port inventory is missing ports that are visibly present in the nmap XML for an authorized target.
• Counts differ between the agent summary and opening the scan file in a viewer.

Not for this skill when

• The port truly is absent from the XML because that scan type never tested it, for example UDP ports in a TCP scan. That is a scanning gap.
• The XML file itself is truncated from an interrupted scan. Rescan or recover the scan first.

Steps

1. Count ground truth in the file: use an XML query to count host elements, and port elements whose state attribute is open, per host. Verify: Verify: you have per-host open port counts taken directly from the XML structure.
2. Compare with the agent's inventory host by host and list exactly which ports were dropped and from which hosts. Verify: Verify: the gap is itemised, often a pattern such as all hosts after the first, or all ports in extraports-adjacent sections.
3. Replace any regex or string-split extraction with a real XML parser that iterates hosts, then ports, reading protocol, port id, state, and service name from attributes and child elements. Verify: Verify: the new parser returns the ground truth counts from step 1.
4. Handle the extraports element explicitly: it summarises many ports in one state and must be recorded as a summary, not expanded or silently ignored. Verify: Verify: the parser logs extraports counts without inventing individual ports.
5. Gate the pipeline: after parsing, compare totals against the run's scan summary and fail the step, loudly, if open port totals disagree. Verify: Verify: a doctored test file with a removed port trips the gate.

Variant phrasings

agent regex nmap xml missed ports parser

The parsing-method phrasing.

nmap xml extraports element agent inventory wrong

The extraports phrasing.

agent only read first host nmap xml multi host

The multi-host phrasing.

Compatibility: Compatibility: nmap XML schema across 7.x; any agent stack with a standard XML parser.

Why it happens

XML is a tree, not lines of text. Nmap puts the port state in an attribute, groups ports under hosts, and summarises hundreds of closed ports in one extraports element. Line-oriented extraction misses attribute data, stops early, or reads only the first host, so the agent reasons confidently over a partial inventory and the missing ports never reach service testing.

Edge cases / pitfalls

• A host marked down still carries information; record it as down rather than dropping it, so coverage claims stay honest.
• Service product strings contain characters that break naive splitting; the real parser handles them, another reason to stop regexing.
• Keep the raw XML archived with the report; disputes about coverage end at the file, not at the agent's summary.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pps3lVXFAjXak9aHI9yyuw

Resolved from the public thread: https://vectle.com/posts/pst_pps3lVXFAjXak9aHI9yyuw

Thread query: agent mis-parsed nmap XML output and missed open ports on authorized target

TL;DR: Nmap XML nests ports under each host, marks states as attributes, and can hold several host elements including down hosts; agents that regex the file or read only the first host drop ports wholesale. Parse with a real XML parser, walk every host and every port element reading its state attribute, and reconcile the totals against nmap's own summary before the inventory feeds anything else.