Comparison Between Local Nmap Execution and Python Subprocess Execution

Automation is becoming a core skill in cybersecurity. While tools like Nmap are powerful on their own, integrating them into programmable workflows unlocks a completely new level of flexibility and scalability.

In this article, I compare two approaches to running Nmap:

• Executing Nmap manually via Windows Command Prompt
• Executing Nmap programmatically using Python’s subprocess module

The goal of this experiment is simple: understand how traditional command-line security tools can evolve into automation-ready components.

Objective

The objective of this experiment was to analyze and compare the output and behavior of Nmap when executed:

1. Directly through the Windows Command Prompt (Manual Method)
2. Programmatically using Python’s subprocess module (Automated Method)

By comparing both methods, we can better understand the benefits of automation and structured output handling.

Environment Details :

• Operating System: Windows 10
• Nmap Version: 7.97
• Python Version: 3.x
• Execution Method 1: Command Prompt (Manual)
• Execution Method 2: Python Script using subprocess

Method 1: Manual Nmap Execution (Local CMD)

nmap www.google.com

Observed Output Summary

• Host: www.google.com
• IP Address: 142.250.67.4 / 142.250.67.196
• Host Status: Up
• Latency: ~0.17 seconds
• Ports Scanned: 1000 default TCP ports

Open Ports Identified

Port    State   Service
80  Open    HTTP
443 Open    HTTPS
2222    Open    EtherNetIP

Total Scan Time

Approximately 25.39 seconds

Observations

1. 997 ports were filtered (no response)
2. Default Nmap scans the top 1000 TCP ports
3. Output is displayed directly in the terminal
4. The result format is plain text with no structured data

This method is straightforward and effective for quick, manual inspections.

Method 2: Python Subprocess Execution

Approach

In this method, Python’s subprocess.run() was used to execute the same Nmap command programmatically.

Observed Output Summary

• Host: WWW.GOOGLE.COM
• IP Address: 142.250.67.196
• Host Status: Up
• Latency: ~0.018 seconds
• Ports Scanned: 1000 default TCP ports

Open Ports Identified

Port    State   Service
80  Open    HTTP
443 Open    HTTPS
2222    Open    EtherNetIP

Total Scan Time

Approximately 15.34 seconds

Observations :

• 996 filtered ports + 1 net-unreachable
• Output was captured programmatically inside Python
• Results can be stored, parsed, logged, or processed
• Enables automation and integration into larger systems This approach transforms Nmap from a standalone tool into part of a programmable workflow.

Comparative Analysis :

Key Differences Observed :

Both methods produced identical open port results.

1. The subprocess method allows capturing output into variables.
2. Python execution enables structured processing.
3. Automation significantly reduces manual effort.
4. Subprocess execution enables integration with larger cybersecurity systems.

The variation in scan time may be influenced by:

1. Network latency differences
2. DNS resolution timing
3. System load during execution

Conclusion :

Both manual and subprocess-based executions produce equivalent scanning results when using identical Nmap commands.

However, the subprocess method provides major advantages:

• Automation
• Output handling
• Structured parsing
• Scalability
• Integration into security applications

This experiment demonstrates how traditional command-line tools like Nmap can be transformed into programmable and scalable cybersecurity automation solutions using Python.

Moving forward, this approach can serve as a foundation for building more advanced security tools such as automated vulnerability scanners, logging systems, or security dashboards