参数：

-sn #ping探测扫描主机， 不进行端口扫描 
-O  显示是什么系统
-sV 版本检测
-A 扫描版本和系统
-p 扫描指定端口 如-p 1-65535 或 -p 80,8080,800,8888
-T4 扫描速度 (1-5)
-sS 二次握手
--exclude 排除主机或网络
--excludefile 排除文件中的网络


-PE 可绕防火墙
-Pn 不采用Ping方式扫描，可绕防火墙
nmap 10.0.1.161 -sA #发送tcp的ack包进行探测，可以探测主机是否存活
nmap  -sS 10.0.1.161 #半开放扫描
nmap -sU 10.0.1.161 #udp端口的扫描
nmap -e eth0 10.0.1.161 -S 10.0.1.167 -Pn #指定网卡扫描，且 -S 参数后为伪造IP

IP范围
192.168.1.1/24
192.168.1-100.1-255
192.168.1.*
192.168.1.1,192.168.1.150

使用

nmap -v -sn -PE -n --min-hostgroup 1024 --min-parallelism 1024 -oX aaaaa.xml 172.220.*.*

XML提取脚本（Python2）

pip2 install python-libnmap

#!/usr/bin/env python

import argparse
from libnmap.process import NmapProcess
from libnmap.parser import NmapParser, NmapParserException

def parse_args():
    ''' Create the arguments '''
    parser = argparse.ArgumentParser()
    parser.add_argument("-x", "--nmapxml", help="Nmap XML file to parse")
    parser.add_argument("-l", "--hostlist", help="Host list file")
    return parser.parse_args()

def report_parser(report):
    ''' Parse the Nmap XML report '''
    for host in report.hosts:
        ip = host.address

        if host.is_up():
            hostname = 'N/A'
            # Get the first hostname (sometimes there can be multi)
            if len(host.hostnames) != 0:
                hostname = host.hostnames[0]

            print '[*] {0} - {1}'.format(ip, hostname)

            # Get the port and service
            # objects in host.services are NmapService objects
            for s in host.services:

                # Check if port is open
                if s.open():
                    serv = s.service
                    port = s.port
                    ban = s.banner

                    # Perform some action on the data
                    print_data(ip, port, serv, ban)

def print_data(ip, port, serv, ban):
    ''' Do something with the nmap data '''
    if ban != '':
        ban = ' -- {0}'.format(ban)
    print ip,port,serv,ban

    #print '    {0}: {1}{2}'.format(port, serv, ban)
    #print '    {0}: {1}{2}'.format(port, serv, ban)

def main():
    args = parse_args()
    report = NmapParser.parse_fromfile(args.nmapxml)
    report_parser(report)

main()

python2 use.py -x aaa.xml