Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to secure my computer against local network attacks for when I'm at university or a LAN party.

Does running a nmap scan against my own IP go through the firewall or does it bypass the firewall?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

The packets always pass the client firewall, but gets routed on your computer (these packets do not go outside the machine).

You can confirm it by using a packet sniffer like Wireshark or iptables. Using iptables:

  1. Temporary flush (remove) all firewall rules: sudo iptables -F
  2. Add an rule for capturing local traffic (traffic that comes from the loopback adapter):

    sudo iptables -A INPUT -i lo -j ACCEPT
    
  3. Watch the number of packets hitting the rule:

    sudo watch -n1 iptables -vnL
    
  4. Open a new terminal window and test whether the packets go outside or not:

    nmap [your-network-ip]
    
  5. Check the command from #3, you'll see like 2000 hits (first column)
  6. (optional) test for an other IP, e.g. nmap 8.8.8.8. No packets will be caught by the rule from #2.
share|improve this answer
    
Sorry, forgot to mention that I'm using Windows 7... –  Tom Wijsman Apr 6 '11 at 12:39
    
@Tom Wijsman: right. You can use Wireshark then, the idea remanins the same. Listen on the loopback adapter and run nmap. (or do the opposite: run it on your ethernet/ wireless connection) –  Lekensteyn Apr 6 '11 at 12:45
    
just to clarify by "the firewall" you mean a hardware firewall out on the university network yes ? Not the firewall of the actual machine your scanning ? i.e: Are you worried abuot the network admins getting annoyed at your scanning, or are you trying to check your local firewall works ? –  Sirex Apr 6 '11 at 12:45
    
@Sirex: By firewall, I mean the firewall on my machine, thus checking if it works. –  Tom Wijsman Apr 6 '11 at 12:50
add comment

if you run it from the same machine as your scanning, no - it doesn't leave your machine. It does hit your local firewall rules though. This applies for both localhost interfaces and your Network card IPs.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.