Keep certain blocks of text

737simpilot

So I’m doing a project for a firewall script I’m using and rather than pay Shodan a massive amount of money to obtain the data I figured I’d do it myself via Zenmap. Now I have blocks of results that have to be filtered. This is what I have:

Nmap scan report for such*such.net (12.3.4)

Host is up (0.14s latency).

PORT STATE SERVICE

53/tcp filtered cwmp

Nmap scan report for such&such.com (4.3.2.1)

Host is up (0.14s latency).

PORT STATE SERVICE

53/tcp open cwmp

So what I need is the chunk of text that says that IP has an open port.
I count 8 lines after the “Nmap scan report…” to the open port part of 53. Is there a plugin that can do this? If so, how would I do this?

Thanks.

PeterJones

@737simpilot ,

No plugin, specifically. But I think your goal can be met with the regular expression searching (regex) and bookmarking built into Notepad++.

It’s hard to tell exactly how bad your text has been mangled by the forum (use the </> button when making your post to make sure the text is treated as plain text, rather than being in forum markdown), which might influence the exact makeup of the regex. But my first guess for a solution, assuming it’s always exactly 8 lines in the match, and that the port always has to say exacty 53/tcp open cwmp on the eighth line.

Search > Mark
FIND WHAT = ^Nmap scan report for(.*\R){7}^53/tcp open cwmp
- start of line, the literal text Nmap scan report for, followed by 7 instances of anything up to the newline sequence, followed by exactly 53/tcp open cwmp
Search Mode = regular expression
enable ☑ Bookmark Line
click Clear all marks if you already have previous bookmarks that you want to get rid of
click Mark All

What you do next depends on what you want to do with the matching data.

If you want all the matching data in the Windows clipboard to paste somewhere else, Copy Marked Text in the dialog, and paste it wherever you want
If you want to delete everything that’s not a matching section, then go to the Search menu, then the Bookmark > submenu, and Remove Unbookmarked Lines
That **Search > Bookmark > ** submenu has many other options for manipulating the bookmarked

For more info on bookmarking, see https://npp-user-manual.org/docs/searching/#highlighting-and-bookmarking

Example Data (using the formatting hint from above, also mentioned in the footnote at the bottom):

Nmap scan report for such*such.net (12.3.4)
Host is up (0.14s latency).
PORT STATE SERVICE
53/tcp filtered cwmp
Nmap scan report for such&such.com (4.3.2.1)
Host is up (0.14s latency).
PORT STATE SERVICE
53/tcp open cwmp
Nmap scan report for such*such.net (12.3.4)
Host is up (0.14s latency).
PORT STATE SERVICE
53/tcp filtered cwmp
Nmap scan report for such&such.com (4.3.2.1)
Host is up (0.14s latency).
PORT STATE SERVICE
53/tcp closed so don't match
Nmap scan report for such*such.net (12.3.4)
Host is up (0.14s latency).
PORT STATE SERVICE
53/tcp filtered cwmp
Nmap scan report for such&such.com (4.3.2.1)
Host is up (0.14s latency).
PORT STATE SERVICE
53/tcp open cwmp

In this example, I believe you want the first 8 lines and the last 8 lines to match, but not the center 8 lines.
For me, it does match:

If this isn’t sufficient for you, please follow the advice below and clarify.

----

Do you want regex search/replace help? Then please be patient and polite, show some effort, and be willing to learn; answer questions and requests for clarification that are made of you. All example text should be marked as literal text using the </> toolbar button or manual Markdown syntax. To make regex in red (and so they keep their special characters like *), use backticks, like `^.*?blah.*?\z`. Screenshots can be pasted from the clipboard to your post using Ctrl+V to show graphical items, but any text should be included as literal text in your post so we can easily copy/paste your data. Show the data you have and the text you want to get from that data; include examples of things that should match and be transformed, and things that don’t match and should be left alone; show edge cases and make sure you examples are as varied as your real data. Show the regex you already tried, and why you thought it should work; tell us what’s wrong with what you do get. Read the official NPP Searching / Regex docs and the forum’s Regular Expression FAQ. If you follow these guidelines, you’re much more likely to get helpful replies that solve your problem in the shortest number of tries.