Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How can I prevent someone from scanning my Windows box using Nmap? I used Comodo as my firewall but someone still can scan my box using Nmap and get some info like open services and OS detection.

share|improve this question
4  
If you want legitimate traffic (such as the postman ringing your bell to deliver an oversize package), you can't prevent others from detecting your existence (such as schoolkids ringing your bell and running away). –  Gilles Nov 14 '13 at 10:29
    
Prevent scanning? You can't. Limit what is found? That's a different story. What are you trying to protect against? –  schroeder Nov 14 '13 at 20:40
    
@schroeder, I want to prevent someone from getting some information regarding my Windows box, so this can prevent (or slow them down) from planning to make another attacks later. Yes, limit what is found is also a good idea. :) –  Mohd Shahril Nov 15 '13 at 1:09
add comment

closed as too broad by NULLZ, Scott Pack, Xander, AJ Henderson, Iszi Nov 14 '13 at 19:04

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

4 Answers

If you configure your firewall to block all incoming packets, then an nmap scan will show nothing, and OS detection will fail.

If you want have some open services, you can restrict them by source IP address, and scans from other IP addresses will not detect them.

If you need services open to the whole internet, then port scans will detect these. There's no way round that.

share|improve this answer
add comment

There is nothing which you can do really. The best you can do is use a HIDS like OSSEC which will automatically block an IP once it notices it's getting scanned. Note that this means the attacker might get some results, but he should be blocked quite rapidly depending on the aggressiveness of the scan.

share|improve this answer
add comment

Cisco ASA threat detection will detect the scan after seeing a few packets and shun the IP temporarily, but the other posters are right -- if you want to get a package you've got to have a working doorbell.

share|improve this answer
add comment

You can also enable logging for "dropped" and "successful connections" packets (default option is NO).

Run > wf.msc > Windows Firewall Rules > "Slect your profile" > Logging > Customize.

For PowerShell you can use Get-Command "Firewall". Before and after word "firewall" you should put *.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.