How can I prevent someone from scanning my Windows box using Nmap? I used Comodo as my firewall but someone still can scan my box using Nmap and get some info like open services and OS detection.

closed as too broad by NULLZ, Scott Pack, Xander, AJ Henderson, Iszi Nov 14 '13 at 19:04

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    If you want legitimate traffic (such as the postman ringing your bell to deliver an oversize package), you can't prevent others from detecting your existence (such as schoolkids ringing your bell and running away). – Gilles Nov 14 '13 at 10:29
  • Prevent scanning? You can't. Limit what is found? That's a different story. What are you trying to protect against? – schroeder Nov 14 '13 at 20:40
  • @schroeder, I want to prevent someone from getting some information regarding my Windows box, so this can prevent (or slow them down) from planning to make another attacks later. Yes, limit what is found is also a good idea. :) – Mohd Shahril Nov 15 '13 at 1:09

If you configure your firewall to block all incoming packets, then an nmap scan will show nothing, and OS detection will fail.

If you want have some open services, you can restrict them by source IP address, and scans from other IP addresses will not detect them.

If you need services open to the whole internet, then port scans will detect these. There's no way round that.


There is nothing which you can do really. The best you can do is use a HIDS like OSSEC which will automatically block an IP once it notices it's getting scanned. Note that this means the attacker might get some results, but he should be blocked quite rapidly depending on the aggressiveness of the scan.


Cisco ASA threat detection will detect the scan after seeing a few packets and shun the IP temporarily, but the other posters are right -- if you want to get a package you've got to have a working doorbell.


You can also enable logging for "dropped" and "successful connections" packets (default option is NO).

Run > wf.msc > Windows Firewall Rules > "Slect your profile" > Logging > Customize.

For PowerShell you can use Get-Command "Firewall". Before and after word "firewall" you should put *.

Not the answer you're looking for? Browse other questions tagged or ask your own question.