why `nmap 192.168.1.97` returns less services than `nmap 127.0.0.1`?

Question

According to https://networkengineering.stackexchange.com/a/57909/, a packet sent to 192.168.1.97 "doesn't leave the host but is treated like a packet received from the network, addressed to 192.168.1.97." So same as sending a packet to loop back 127.0.0.1.

why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?

Does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

$ nmap -p0-65535 192.168.1.97

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for ocean (192.168.1.97)
Host is up (0.00039s latency).
Not shown: 65532 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
111/tcp   open  rpcbind
3306/tcp  open  mysql
33060/tcp open  mysqlx

Nmap done: 1 IP address (1 host up) scanned in 9.55 seconds

$ nmap -p0-65535 localhost

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00033s latency).
Other addresses for localhost (not scanned):
Not shown: 65529 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
111/tcp   open  rpcbind
631/tcp   open  ipp
3306/tcp  open  mysql
5432/tcp  open  postgresql
9050/tcp  open  tor-socks
33060/tcp open  mysqlx

Nmap done: 1 IP address (1 host up) scanned in 5.39 seconds

Thanks.

Because not all services are listening on the external interface? — Kusalananda, Mar 23 '19 at 22:57
@Kusalananda In particular, does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at `192.168.1.97` necessarily also listen at `127.0.0.1`? — Tim, Mar 23 '19 at 23:21
They're different addresses, why would a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1? — 炸鱼薯条德里克, Mar 24 '19 at 01:35
Somehow, I don't think the other guy on Network Engineering answered correctly. When you specify an ip address to send packet, it would have to go to router to be . . . routed, duh. But `localhost` would be resolved to 127.0.0.1 just like 127.0.0.1 itself would be understood as loopback. — Sergiy Kolodyazhnyy, Mar 24 '19 at 05:03
The final paragraph of that answer answers your question, does it not? — Lightness Races in Orbit, Mar 24 '19 at 14:33
It's completely normal to have more local services open on 127.0.0.1 than in other interaces. — Pedro Lobito, Mar 24 '19 at 21:43

score 8 · Accepted Answer · answered Mar 24 '19 at 00:16

8

In short, they are two different interfaces (192.168.1.97 vs 127.0.0.1), and may have different firewall rules applied and/or services listening. Being on the same machine means relatively little.

answered Mar 24 '19 at 00:16

John

16,759
1
34
43

Thanks. Does `nmap -p0-65535 0.0.0.0` scan all the IP addresses on the local host, and report services listening at ports at all these IP addresses including 192.168.1.97 and 127.0.0.1? – Tim Mar 24 '19 at 21:53
No. It scans only a single IP address, 0.0.0.0. Which is not really a valid host IP. – John Mar 25 '19 at 01:39

score 7 · Answer 2 · answered Mar 23 '19 at 23:35

7

No, a service listening to a port on an external interface does not necessarily also listen on that port on localhost.

You can test this with something like

nc -l external-ip-address port-number

Then run nmap against localhost, then against the external IP address.

answered Mar 23 '19 at 23:35

Kusalananda

320,670
36
633
936

Thanks. What do you mean by an "external interface"? What is an "internal interface"? The IP address 192.168.1.97 in my post is private (internal), not public (external). – Tim Mar 24 '19 at 21:50
@Tim By "external" interface, I meant "an interface that is accessible from the outside", as opposed to an internal interface, the loopback interface. I believe I might have used the terms quite loosely to differentiate externally available services (services listening to an address that is externally visible) and services only available on 127.0.0.1. – Kusalananda Mar 24 '19 at 21:54

score 6 · Answer 3 · answered Mar 24 '19 at 01:03

why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?

Because to improve security many services are configured by default to only listen on 127.0.0.1 (and/or the IPv6 equivilent ::1)

Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

No

Generally a service can create a listening socket to listen on.

A specific IP, such a listening socket will only accept traffic destined for that specific IP.
0.0.0.0 , this will accept traffic to all IPv4 IPs assigned to the machine.
:: this will accept traffic to all IPv6 IPs assigned to the machine. It may or may not accept traffic destined to IPv4 IPs on the machine depending on the particular OS, system wide configuration and socket-specific options.

score 2 · Answer 4 · edited Oct 07 '21 at 07:34

The 127-type of address is internal only, as per RFC1122:

Internal host loopback address. Addresses of this form MUST NOT appear outside a host.

This means that those services are listening locally. The 192.168.1.97 is your public-facing address, and that's how router and other computers know you. The 127.0.0.1/8 in a sense is a "simulation" of a network. You can test things with it, you can run local services on and exchange packets between them - essentially same things as you'd do with an actual internet resource. In fact, that's what web developers do: they set up local environment and run XAMP or LAMP stack locally before moving on to production environment when polished product will actually face the internet.

Now, it should not happen that you receive a packet from 127.x.x.x type of address on public facing interface like eth0 or wlan0. If that happens, this is called Martian packet, and it's likely that someone is trying to attack your host or network.

In a certain sense you could make it an analogy between your router and your computer. On LAN, your router has 192.168.1.0 address, but to the internet it is known as 68.125.xx.yy ( disclamer: random example, not an actual IP address intended here ). The router might expose to the internet only port 53 ( DNS ), but internally you could have port 80 ( HTTP control panel ) and 53. Same idea with your computer.

Of course, the services would have to be configured to listen on either public or local interface only. For instance, Redis server comes preconfigured to listen only on 127.0.0.1, because security reasons.

why `nmap 192.168.1.97` returns less services than `nmap 127.0.0.1`?

4 Answers4