Transform nmap IP and MAC scan into csv file using Powershell

nmap_ip_mac_to_csv.md

If you're gathering IP and MAC addresses using nmap on a Windows machine, you can use Powershell to replace awk to transform the output to a comma seperated file, containing the IP and MAC address.

nmap -sP -n -oX scan.xml 192.168.1.0/24 

This call produces an XML file, contining the scanned hosts as XML nodes containing subnodes with address information. The address nodes will be the IP address and the MAC address.

<host>
	<status reason="arp-response" reason_ttl="0" state="up"/>
	<address addr="192.168.1.100" addrtype="ipv4"/>
	<address addr="F1:E2:D3:C4:B5:A6" addrtype="mac" vendor="Manufacturer"/>
	<hostnames/>
	<times rttvar="16000" srtt="16000" to="100000"/>
</host>

You can utilize Select-Xml and it's -XPath argument to select each nmap scan node and extract the address subnodes information as either IP or MAC address string.

Select-Xml -Path scan_1.xml -XPath '/nmaprun/host' | ForEach-Object { 

	$addr = $_.Node.address
	$ip = ''
	$mac = ''

    foreach ($a in $addr){
        if($a.addrtype -eq 'ipv4'){
		    $ip = $a.addr
	    }else{
		    $mac = $a.addr
	    }
    }
 	Write-Output "$($ip);$($mac)"
}

The strings are written to the terminal and can be piped into a file, if you like. If you want to output into a file directlym you can replace Write-Output with Add-Content. You will get this as the ouput:

192.168.1.1;F1:E2:D3:C4:B5:A6
192.168.1.2;F1:E2:D3:C4:B5:A6
192.168.1.3;F1:E2:D3:C4:B5:A6