How can I prevent someone from scanning my Windows box using Nmap? I used Comodo as my firewall but someone still can scan my box using Nmap and get some info like open services and OS detection.
closed as too broad by NULLZ, Scott Pack, Xander, AJ Henderson, Iszi Nov 14 '13 at 19:04
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
If you configure your firewall to block all incoming packets, then an nmap scan will show nothing, and OS detection will fail.
If you want have some open services, you can restrict them by source IP address, and scans from other IP addresses will not detect them.
If you need services open to the whole internet, then port scans will detect these. There's no way round that.
There is nothing which you can do really. The best you can do is use a HIDS like OSSEC which will automatically block an IP once it notices it's getting scanned. Note that this means the attacker might get some results, but he should be blocked quite rapidly depending on the aggressiveness of the scan.
Cisco ASA threat detection will detect the scan after seeing a few packets and shun the IP temporarily, but the other posters are right -- if you want to get a package you've got to have a working doorbell.
You can also enable logging for "dropped" and "successful connections" packets (default option is NO).
Run > wf.msc > Windows Firewall Rules > "Slect your profile" > Logging > Customize.
For PowerShell you can use Get-Command "Firewall". Before and after word "firewall" you should put *.