Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I scanned both localhost, and the IP address of the LAN adapter, and this is the produced output.

Starting Nmap 5.51 ( http://nmap.org ) at 2012-10-12 18:06 Eastern Daylight Time
Skipping SYN Stealth Scan against localhost (127.0.0.1) because Windows does not support scanning your own machine (localhost) this way.
Nmap scan report for localhost (127.0.0.1)
Host is up.
PORT      STATE   SERVICE
1/tcp     unknown tcpmux
3/tcp     unknown compressnet
4/tcp     unknown unknown
6/tcp     unknown unknown
7/tcp     unknown echo
9/tcp     unknown discard
13/tcp    unknown daytime
17/tcp    unknown qotd
19/tcp    unknown chargen
20/tcp    unknown ftp-data
-------redacted-for-posting-purposes-------
60020/tcp unknown unknown
60443/tcp unknown unknown
61532/tcp unknown unknown
61900/tcp unknown unknown
62078/tcp unknown iphone-sync
63331/tcp unknown unknown
64623/tcp unknown unknown
64680/tcp unknown unknown
65000/tcp unknown unknown
65129/tcp unknown unknown
65389/tcp unknown unknown

Nmap done: 1 IP address (1 host up) scanned in 0.11 seconds

Unknown for all ports scanned. I then proceeded to scan "scanme.nmap.org", and had regular output as expected upon scanning that service.

Any suggestions?

share|improve this question
1  
Hmm.. you are comparing a scan of localhost to a scan of a remote Internet host on the other side of a few routers and firewalls so there are likely to be many differences in the output. How can you verify nmap's results? –  adric Oct 12 '12 at 22:18
1  
@adric I would think the most problematic scan between the two should be the Internet-based system. The confusing problem here is that the situation appears entirely reversed. –  Iszi Oct 12 '12 at 22:51
2  
Please list all switches you used for the scan. -sL will always result in 'unknown' for example ... –  schroeder Oct 12 '12 at 23:18
    
The answer is in your output: "Windows does not support scanning your own machine (localhost) this way" –  bonsaiviking Oct 13 '12 at 0:49
1  
It is not advisable to use nmap on windows. –  Terry Chia Oct 13 '12 at 5:37

1 Answer 1

The problem is with Windows and scanning the local machine. Nmap on Windows does not work the same way as it does on Linux due to differences in how the NIC is accessed. It is not actually connecting to each port from a separate process, but is connecting to itself. This is why the scan results in all ports being listed, and results in the connection to each port being omitted.

As a test, scan port 8 and 18 (omitted in the scan above). Assuming you originally did a default scan, those ports would not be tested. If you specifically test them, they should show up as 'unknown', too.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.