It is a common desire to run the same scan twice at different times,
or run two slightly different scans at the same time, and see how they
differ. Zenmap provides a rich interface to comparing scan results,
shown in Figure 12.11, “Comparison tool” Open the comparison
tool by selecting “Compare Results” from the
“Tools” menu or by using the
ctrl+D (think
“diff”) keyboard shortcut. Zenmap supports comparing two
scan results at a time.
The first step in performing a comparison is selecting the two scans
to compare. The combo boxes under “Scan Result 1”
and “Scan Result 2” allow you to choose from open
scan tabs. Or click the “Open” buttons to get
scan results from a file. To compare results from the recent scans
database, you must first open them into a scan tab through the search
interface (see the section called “Searching through results”).
The distinction between Scan Result 1 and Scan Result 2 is important.
Comparison are always done from Scan Result 1 to Scan Result 2, that
is, how Scan Result 2 differs from Scan Result 1. Once the two results
have been chosen the comparison is done immediately.
Figure 12.12, “Graphical comparison” shows a comparison of a
regular scan and an intense scan of the same host.
The differences and similarities of the two scans is shown
hierarchically and in colors. Each color also has a letter code that
describes how that part of the scan changed (or not). The codes are:
U
for unchanged, A
for added,
M
for modified, and N
for not
present (or deleted). The colors can be modified by clicking the
“Color Descriptions” button (shown in Figure 12.13, “Comparison colors”), then clicking on a color.
The color descriptions dialog also has definitions of the letter
codes in case you forget.
An alternative view of the comparison is the text mode, which is
activated by clicking the “Text Mode” button. A
text mode comparison of the same two scans is shown in Figure 12.14, “Text mode comparison” The text mode can be
cut and pasted into a file or an email message.
The output of a text mode comparison is similar to that of the Unix
diff tool. Each line begins with a
character indicating the meaning of the line. The possible character
codes are shown in Table 12.3, “Text diff character codes”
Table 12.3. Text diff character codes
Code | Meaning |
---|
“ ” (space) | The line is identical in both scans. |
+ | The line was added in the second scan. |
- | The line was removed in the second scan. |
? | ^ , + , and
- characters on the remainder of the line
indicate which characters were modified, added, or removed,
respectively, in the line immediately above. |
An HTML rendering of the text difference can be viewed by clicking
the “Open in Browser” button. This view is
meant to be saved for archival purposes or printed for a report.