Pathfinder - nmap traceroute graphing

Generates a graph of the traceroute information in nmap XML files using graphviz. The tool was specifically written to process very large nmap reports (> 2 GB).

The traceroute information can give insight into the network topology, e.g.:

• Identify exposed systems not protected by the firewall
• Identify separate network segments

The following graph shows an example of the traceroute for the targets scanme.nmap.org and nmap.org (sudo nmap -sn --traceroute -oA nmap scanme.nmap.org nmap.org):

Why not just use Zenmap

• Handling of huge files (pathfinder parses nmap report files line by line and can therefore process huge files)
• (Manual) Customization of final graph (graphviz dot syntax)

Requirements:

• pygraphviz
• untangle
• lxml

Usage

             _   _      __ _           _                 
 _ __   __ _| |_| |__  / _(_)_ __   __| | ___ _ __   
| '_ \ / _` | __| '_ \| |_| | '_ \ / _` |/ _ \ '__| 
| |_) | (_| | |_| | | |  _| | | | | (_| |  __/ |     
| .__/ \__,_|\__|_| |_|_| |_|_| |_|\__,_|\___|_|    
|_|                                                      
      ------------------------------------->
                               _                                      _                                _     _             
 _ __  _ __ ___   __ _ _ __   | |_ _ __ __ _  ___ ___ _ __ ___  _   _| |_ ___     __ _ _ __ __ _ _ __ | |__ (_)_ __   __ _ 
| '_ \| '_ ` _ \ / _` | '_ \  | __| '__/ _` |/ __/ _ \ '__/ _ \| | | | __/ _ \   / _` | '__/ _` | '_ \| '_ \| | '_ \ / _` |
| | | | | | | | | (_| | |_) | | |_| | | (_| | (_|  __/ | | (_) | |_| | ||  __/  | (_| | | | (_| | |_) | | | | | | | | (_| |
|_| |_|_| |_| |_|\__,_| .__/   \__|_|  \__,_|\___\___|_|  \___/ \__,_|\__\___|   \__, |_|  \__,_| .__/|_| |_|_|_| |_|\__, |
                      |_|                                                        |___/          |_|                  |___/ 

    Info: Generates a graph via graphviz of the traceroute information in nmap XML files (nmap --traceroute [...]).

    pathfinder.py -i <nmap_xml_input_file> -o <outputfile> [-s <True|False>] [-d <True|False>]


    --help		This help text
    --ifile		The Nmap XML file to parse for traceroute information
    --ofile		Filename for output files: Graphviz dot and png file
    --skipDestHost	(Optional) For better visibility in huge scans the destination host can be excluded 
                        from the graph resulting in only the route information.
    --destIpToNetwork	(Optional) For better visibility in huge scans the destination IP can be transformed
                        into a class C network (e.g. 192.168.1.2 -> 192.168.1.0/24).