2

How can I prevent someone from scanning my Windows box using Nmap? I used Comodo as my firewall but someone still can scan my box using Nmap and get some info like open services and OS detection.

3
  • 5
    If you want legitimate traffic (such as the postman ringing your bell to deliver an oversize package), you can't prevent others from detecting your existence (such as schoolkids ringing your bell and running away). Commented Nov 14, 2013 at 10:29
  • Prevent scanning? You can't. Limit what is found? That's a different story. What are you trying to protect against?
    – schroeder
    Commented Nov 14, 2013 at 20:40
  • @schroeder, I want to prevent someone from getting some information regarding my Windows box, so this can prevent (or slow them down) from planning to make another attacks later. Yes, limit what is found is also a good idea. :) Commented Nov 15, 2013 at 1:09

4 Answers 4

3

If you configure your firewall to block all incoming packets, then an nmap scan will show nothing, and OS detection will fail.

If you want have some open services, you can restrict them by source IP address, and scans from other IP addresses will not detect them.

If you need services open to the whole internet, then port scans will detect these. There's no way round that.

1

There is nothing which you can do really. The best you can do is use a HIDS like OSSEC which will automatically block an IP once it notices it's getting scanned. Note that this means the attacker might get some results, but he should be blocked quite rapidly depending on the aggressiveness of the scan.

0

Cisco ASA threat detection will detect the scan after seeing a few packets and shun the IP temporarily, but the other posters are right -- if you want to get a package you've got to have a working doorbell.

0

You can also enable logging for "dropped" and "successful connections" packets (default option is NO).

Run > wf.msc > Windows Firewall Rules > "Slect your profile" > Logging > Customize.

For PowerShell you can use Get-Command "Firewall". Before and after word "firewall" you should put *.

Not the answer you're looking for? Browse other questions tagged .