Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to secure my computer against local network attacks for when I'm at university or a LAN party.

Does running a nmap scan against my own IP go through the firewall or does it bypass the firewall?

share|improve this question
up vote 2 down vote accepted

The packets always pass the client firewall, but gets routed on your computer (these packets do not go outside the machine).

You can confirm it by using a packet sniffer like Wireshark or iptables. Using iptables:

  1. Temporary flush (remove) all firewall rules: sudo iptables -F
  2. Add an rule for capturing local traffic (traffic that comes from the loopback adapter):

    sudo iptables -A INPUT -i lo -j ACCEPT
  3. Watch the number of packets hitting the rule:

    sudo watch -n1 iptables -vnL
  4. Open a new terminal window and test whether the packets go outside or not:

    nmap [your-network-ip]
  5. Check the command from #3, you'll see like 2000 hits (first column)
  6. (optional) test for an other IP, e.g. nmap No packets will be caught by the rule from #2.
share|improve this answer
Sorry, forgot to mention that I'm using Windows 7... – Tom Wijsman Apr 6 '11 at 12:39
@Tom Wijsman: right. You can use Wireshark then, the idea remanins the same. Listen on the loopback adapter and run nmap. (or do the opposite: run it on your ethernet/ wireless connection) – Lekensteyn Apr 6 '11 at 12:45
just to clarify by "the firewall" you mean a hardware firewall out on the university network yes ? Not the firewall of the actual machine your scanning ? i.e: Are you worried abuot the network admins getting annoyed at your scanning, or are you trying to check your local firewall works ? – Sirex Apr 6 '11 at 12:45
@Sirex: By firewall, I mean the firewall on my machine, thus checking if it works. – Tom Wijsman Apr 6 '11 at 12:50

if you run it from the same machine as your scanning, no - it doesn't leave your machine. It does hit your local firewall rules though. This applies for both localhost interfaces and your Network card IPs.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .