why `nmap 192.168.1.97` returns less services than `nmap 127.0.0.1`?2019 Community Moderator ElectionDifference between `nmap local-IP-address` and `nmap localhost`Doing nmap on a networkCan you send a TCP packet with RST flag set using IPTABLES as a way to trick NMAP into thinking a port is closed?How to tell stateful vs stateless firewall with nmap ACK scanWhy nmap closed my connection?telnet to an host/port works while no service on this host listening on this portnmap raw packet privileges not working (“operation not permitted”, even as root)Why REJECT slows nmap?specifying more than one character on nmap --ip-optionsExhaustive list of REASONs why a host/server might be down (nmap --reason)What are those “unknown” services listed by nmap?

Offered money to buy a house, seller is asking for more to cover gap between their listing and mortgage owed

Why did the HMS Bounty go back to a time when whales are already rare?

Why Shazam when there is already Superman?

Does a 'pending' US visa application constitute a denial?

Longest common substring in linear time

Melting point of aspirin, contradicting sources

Closed-form expression for certain product

Should I stop contributing to retirement accounts?

Count the occurrence of each unique word in the file

Is it safe to use olive oil to clean the ear wax?

Calculating Wattage for Resistor in High Frequency Application?

What is Cash Advance APR?

Creepy dinosaur pc game identification

The screen of my macbook suddenly broken down how can I do to recover

What if a revenant (monster) gains fire resistance?

Is it improper etiquette to ask your opponent what his/her rating is before the game?

What is the evidence for the "tyranny of the majority problem" in a direct democracy context?

Why did the EU agree to delay the Brexit deadline?

How to explain what's wrong with this application of the chain rule?

How much character growth crosses the line into breaking the character

250 Floor Tower

Delivering sarcasm

Yosemite Fire Rings - What to Expect?

Drawing ramified coverings with tikz



why `nmap 192.168.1.97` returns less services than `nmap 127.0.0.1`?



2019 Community Moderator ElectionDifference between `nmap local-IP-address` and `nmap localhost`Doing nmap on a networkCan you send a TCP packet with RST flag set using IPTABLES as a way to trick NMAP into thinking a port is closed?How to tell stateful vs stateless firewall with nmap ACK scanWhy nmap closed my connection?telnet to an host/port works while no service on this host listening on this portnmap raw packet privileges not working (“operation not permitted”, even as root)Why REJECT slows nmap?specifying more than one character on nmap --ip-optionsExhaustive list of REASONs why a host/server might be down (nmap --reason)What are those “unknown” services listed by nmap?










2















According to https://networkengineering.stackexchange.com/a/57909/, a packet sent to 192.168.1.97 "doesn't leave the host but is treated like a packet received from the network, addressed to 192.168.1.97." So same as sending a packet to loop back 127.0.0.1.



why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?



Does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?



$ nmap -p0-65535 10.44.104.250

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for ocean (10.44.104.250)
Host is up (0.00039s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
3306/tcp open mysql
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 9.55 seconds

$ nmap -p0-65535 localhost

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00033s latency).
Other addresses for localhost (not scanned):
Not shown: 65529 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
631/tcp open ipp
3306/tcp open mysql
5432/tcp open postgresql
9050/tcp open tor-socks
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 5.39 seconds


Thanks.










share|improve this question
























  • Because not all services are listening on the external interface?

    – Kusalananda
    4 hours ago






  • 4





    Possible duplicate of Difference between `nmap local-IP-address` and `nmap localhost`

    – Jeff Schaller
    4 hours ago











  • Seems to me that Rui's Answer there applies here.

    – Jeff Schaller
    4 hours ago











  • @Kusalananda In particular, does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – Tim
    4 hours ago












  • They're different addresses, why would a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – 炸鱼薯条德里克
    2 hours ago















2















According to https://networkengineering.stackexchange.com/a/57909/, a packet sent to 192.168.1.97 "doesn't leave the host but is treated like a packet received from the network, addressed to 192.168.1.97." So same as sending a packet to loop back 127.0.0.1.



why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?



Does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?



$ nmap -p0-65535 10.44.104.250

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for ocean (10.44.104.250)
Host is up (0.00039s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
3306/tcp open mysql
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 9.55 seconds

$ nmap -p0-65535 localhost

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00033s latency).
Other addresses for localhost (not scanned):
Not shown: 65529 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
631/tcp open ipp
3306/tcp open mysql
5432/tcp open postgresql
9050/tcp open tor-socks
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 5.39 seconds


Thanks.










share|improve this question
























  • Because not all services are listening on the external interface?

    – Kusalananda
    4 hours ago






  • 4





    Possible duplicate of Difference between `nmap local-IP-address` and `nmap localhost`

    – Jeff Schaller
    4 hours ago











  • Seems to me that Rui's Answer there applies here.

    – Jeff Schaller
    4 hours ago











  • @Kusalananda In particular, does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – Tim
    4 hours ago












  • They're different addresses, why would a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – 炸鱼薯条德里克
    2 hours ago













2












2








2








According to https://networkengineering.stackexchange.com/a/57909/, a packet sent to 192.168.1.97 "doesn't leave the host but is treated like a packet received from the network, addressed to 192.168.1.97." So same as sending a packet to loop back 127.0.0.1.



why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?



Does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?



$ nmap -p0-65535 10.44.104.250

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for ocean (10.44.104.250)
Host is up (0.00039s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
3306/tcp open mysql
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 9.55 seconds

$ nmap -p0-65535 localhost

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00033s latency).
Other addresses for localhost (not scanned):
Not shown: 65529 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
631/tcp open ipp
3306/tcp open mysql
5432/tcp open postgresql
9050/tcp open tor-socks
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 5.39 seconds


Thanks.










share|improve this question
















According to https://networkengineering.stackexchange.com/a/57909/, a packet sent to 192.168.1.97 "doesn't leave the host but is treated like a packet received from the network, addressed to 192.168.1.97." So same as sending a packet to loop back 127.0.0.1.



why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?



Does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?



$ nmap -p0-65535 10.44.104.250

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for ocean (10.44.104.250)
Host is up (0.00039s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
3306/tcp open mysql
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 9.55 seconds

$ nmap -p0-65535 localhost

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00033s latency).
Other addresses for localhost (not scanned):
Not shown: 65529 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
631/tcp open ipp
3306/tcp open mysql
5432/tcp open postgresql
9050/tcp open tor-socks
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 5.39 seconds


Thanks.







nmap ip-address loopback






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited 4 hours ago







Tim

















asked 4 hours ago









TimTim

28k78269488




28k78269488












  • Because not all services are listening on the external interface?

    – Kusalananda
    4 hours ago






  • 4





    Possible duplicate of Difference between `nmap local-IP-address` and `nmap localhost`

    – Jeff Schaller
    4 hours ago











  • Seems to me that Rui's Answer there applies here.

    – Jeff Schaller
    4 hours ago











  • @Kusalananda In particular, does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – Tim
    4 hours ago












  • They're different addresses, why would a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – 炸鱼薯条德里克
    2 hours ago

















  • Because not all services are listening on the external interface?

    – Kusalananda
    4 hours ago






  • 4





    Possible duplicate of Difference between `nmap local-IP-address` and `nmap localhost`

    – Jeff Schaller
    4 hours ago











  • Seems to me that Rui's Answer there applies here.

    – Jeff Schaller
    4 hours ago











  • @Kusalananda In particular, does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – Tim
    4 hours ago












  • They're different addresses, why would a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – 炸鱼薯条德里克
    2 hours ago
















Because not all services are listening on the external interface?

– Kusalananda
4 hours ago





Because not all services are listening on the external interface?

– Kusalananda
4 hours ago




4




4





Possible duplicate of Difference between `nmap local-IP-address` and `nmap localhost`

– Jeff Schaller
4 hours ago





Possible duplicate of Difference between `nmap local-IP-address` and `nmap localhost`

– Jeff Schaller
4 hours ago













Seems to me that Rui's Answer there applies here.

– Jeff Schaller
4 hours ago





Seems to me that Rui's Answer there applies here.

– Jeff Schaller
4 hours ago













@Kusalananda In particular, does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

– Tim
4 hours ago






@Kusalananda In particular, does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

– Tim
4 hours ago














They're different addresses, why would a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

– 炸鱼薯条德里克
2 hours ago





They're different addresses, why would a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

– 炸鱼薯条德里克
2 hours ago










3 Answers
3






active

oldest

votes


















2














In short, they are two different interfaces (192.168.1.97 vs 127.0.0.1), and may have different firewall rules applied and/or services listening. Being on the same machine means relatively little.






share|improve this answer






























    1














    No, a service listening to a port on an external interface does not necessarily also listen on that port on localhost.



    You can test this with something like



    nc -l external-ip-address port-number


    Then run nmap against localhost, then against the external IP address.






    share|improve this answer






























      1















      why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?




      Because to improve security many services are configured by default to only listen on 127.0.0.1 (and/or the IPv6 equivilent ::1)




      Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?




      No



      Generally a service can create a listening socket to listen on.



      1. A specific IP, such a listening socket will only accept traffic destined for that specific IP.

      2. 0.0.0.0 , this will accept traffic to all IPv4 IPs assigned to the machine.

      3. :: this will accept traffic to all IPv6 IPs assigned to the machine. It may or may not accept traffic destined to IPv4 IPs on the machine depending on the particular OS, system wide configuration and socket-specific options.





      share|improve this answer






















        Your Answer








        StackExchange.ready(function()
        var channelOptions =
        tags: "".split(" "),
        id: "106"
        ;
        initTagRenderer("".split(" "), "".split(" "), channelOptions);

        StackExchange.using("externalEditor", function()
        // Have to fire editor after snippets, if snippets enabled
        if (StackExchange.settings.snippets.snippetsEnabled)
        StackExchange.using("snippets", function()
        createEditor();
        );

        else
        createEditor();

        );

        function createEditor()
        StackExchange.prepareEditor(
        heartbeatType: 'answer',
        autoActivateHeartbeat: false,
        convertImagesToLinks: false,
        noModals: true,
        showLowRepImageUploadWarning: true,
        reputationToPostImages: null,
        bindNavPrevention: true,
        postfix: "",
        imageUploader:
        brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
        contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
        allowUrls: true
        ,
        onDemand: true,
        discardSelector: ".discard-answer"
        ,immediatelyShowMarkdownHelp:true
        );



        );













        draft saved

        draft discarded


















        StackExchange.ready(
        function ()
        StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f508229%2fwhy-nmap-192-168-1-97-returns-less-services-than-nmap-127-0-0-1%23new-answer', 'question_page');

        );

        Post as a guest















        Required, but never shown

























        3 Answers
        3






        active

        oldest

        votes








        3 Answers
        3






        active

        oldest

        votes









        active

        oldest

        votes






        active

        oldest

        votes









        2














        In short, they are two different interfaces (192.168.1.97 vs 127.0.0.1), and may have different firewall rules applied and/or services listening. Being on the same machine means relatively little.






        share|improve this answer



























          2














          In short, they are two different interfaces (192.168.1.97 vs 127.0.0.1), and may have different firewall rules applied and/or services listening. Being on the same machine means relatively little.






          share|improve this answer

























            2












            2








            2







            In short, they are two different interfaces (192.168.1.97 vs 127.0.0.1), and may have different firewall rules applied and/or services listening. Being on the same machine means relatively little.






            share|improve this answer













            In short, they are two different interfaces (192.168.1.97 vs 127.0.0.1), and may have different firewall rules applied and/or services listening. Being on the same machine means relatively little.







            share|improve this answer












            share|improve this answer



            share|improve this answer










            answered 3 hours ago









            JohnJohn

            11.7k11931




            11.7k11931























                1














                No, a service listening to a port on an external interface does not necessarily also listen on that port on localhost.



                You can test this with something like



                nc -l external-ip-address port-number


                Then run nmap against localhost, then against the external IP address.






                share|improve this answer



























                  1














                  No, a service listening to a port on an external interface does not necessarily also listen on that port on localhost.



                  You can test this with something like



                  nc -l external-ip-address port-number


                  Then run nmap against localhost, then against the external IP address.






                  share|improve this answer

























                    1












                    1








                    1







                    No, a service listening to a port on an external interface does not necessarily also listen on that port on localhost.



                    You can test this with something like



                    nc -l external-ip-address port-number


                    Then run nmap against localhost, then against the external IP address.






                    share|improve this answer













                    No, a service listening to a port on an external interface does not necessarily also listen on that port on localhost.



                    You can test this with something like



                    nc -l external-ip-address port-number


                    Then run nmap against localhost, then against the external IP address.







                    share|improve this answer












                    share|improve this answer



                    share|improve this answer










                    answered 4 hours ago









                    KusalanandaKusalananda

                    137k17258426




                    137k17258426





















                        1















                        why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?




                        Because to improve security many services are configured by default to only listen on 127.0.0.1 (and/or the IPv6 equivilent ::1)




                        Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?




                        No



                        Generally a service can create a listening socket to listen on.



                        1. A specific IP, such a listening socket will only accept traffic destined for that specific IP.

                        2. 0.0.0.0 , this will accept traffic to all IPv4 IPs assigned to the machine.

                        3. :: this will accept traffic to all IPv6 IPs assigned to the machine. It may or may not accept traffic destined to IPv4 IPs on the machine depending on the particular OS, system wide configuration and socket-specific options.





                        share|improve this answer



























                          1















                          why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?




                          Because to improve security many services are configured by default to only listen on 127.0.0.1 (and/or the IPv6 equivilent ::1)




                          Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?




                          No



                          Generally a service can create a listening socket to listen on.



                          1. A specific IP, such a listening socket will only accept traffic destined for that specific IP.

                          2. 0.0.0.0 , this will accept traffic to all IPv4 IPs assigned to the machine.

                          3. :: this will accept traffic to all IPv6 IPs assigned to the machine. It may or may not accept traffic destined to IPv4 IPs on the machine depending on the particular OS, system wide configuration and socket-specific options.





                          share|improve this answer

























                            1












                            1








                            1








                            why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?




                            Because to improve security many services are configured by default to only listen on 127.0.0.1 (and/or the IPv6 equivilent ::1)




                            Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?




                            No



                            Generally a service can create a listening socket to listen on.



                            1. A specific IP, such a listening socket will only accept traffic destined for that specific IP.

                            2. 0.0.0.0 , this will accept traffic to all IPv4 IPs assigned to the machine.

                            3. :: this will accept traffic to all IPv6 IPs assigned to the machine. It may or may not accept traffic destined to IPv4 IPs on the machine depending on the particular OS, system wide configuration and socket-specific options.





                            share|improve this answer














                            why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?




                            Because to improve security many services are configured by default to only listen on 127.0.0.1 (and/or the IPv6 equivilent ::1)




                            Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?




                            No



                            Generally a service can create a listening socket to listen on.



                            1. A specific IP, such a listening socket will only accept traffic destined for that specific IP.

                            2. 0.0.0.0 , this will accept traffic to all IPv4 IPs assigned to the machine.

                            3. :: this will accept traffic to all IPv6 IPs assigned to the machine. It may or may not accept traffic destined to IPv4 IPs on the machine depending on the particular OS, system wide configuration and socket-specific options.






                            share|improve this answer












                            share|improve this answer



                            share|improve this answer










                            answered 2 hours ago









                            plugwashplugwash

                            1,901619




                            1,901619



























                                draft saved

                                draft discarded
















































                                Thanks for contributing an answer to Unix & Linux Stack Exchange!


                                • Please be sure to answer the question. Provide details and share your research!

                                But avoid


                                • Asking for help, clarification, or responding to other answers.

                                • Making statements based on opinion; back them up with references or personal experience.

                                To learn more, see our tips on writing great answers.




                                draft saved


                                draft discarded














                                StackExchange.ready(
                                function ()
                                StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f508229%2fwhy-nmap-192-168-1-97-returns-less-services-than-nmap-127-0-0-1%23new-answer', 'question_page');

                                );

                                Post as a guest















                                Required, but never shown





















































                                Required, but never shown














                                Required, but never shown












                                Required, but never shown







                                Required, but never shown

































                                Required, but never shown














                                Required, but never shown












                                Required, but never shown







                                Required, but never shown







                                Popular posts from this blog

                                Reverse int within the 32-bit signed integer range: [−2^31, 2^31 − 1]Combining two 32-bit integers into one 64-bit integerDetermine if an int is within rangeLossy packing 32 bit integer to 16 bitComputing the square root of a 64-bit integerKeeping integer addition within boundsSafe multiplication of two 64-bit signed integersLeetcode 10: Regular Expression MatchingSigned integer-to-ascii x86_64 assembler macroReverse the digits of an Integer“Add two numbers given in reverse order from a linked list”

                                Category:Fedor von Bock Media in category "Fedor von Bock"Navigation menuUpload mediaISNI: 0000 0000 5511 3417VIAF ID: 24712551GND ID: 119294796Library of Congress authority ID: n96068363BnF ID: 12534305fSUDOC authorities ID: 034604189Open Library ID: OL338253ANKCR AUT ID: jn19990000869National Library of Israel ID: 000514068National Thesaurus for Author Names ID: 341574317ReasonatorScholiaStatistics

                                Kiel Indholdsfortegnelse Historie | Transport og færgeforbindelser | Sejlsport og anden sport | Kultur | Kendte personer fra Kiel | Noter | Litteratur | Eksterne henvisninger | Navigationsmenuwww.kiel.de54°19′31″N 10°8′26″Ø / 54.32528°N 10.14056°Ø / 54.32528; 10.14056Oberbürgermeister Dr. Ulf Kämpferwww.statistik-nord.deDen danske Stats StatistikKiels hjemmesiderrrWorldCat312794080n790547494030481-4