Sfdwhf

According to https://networkengineering.stackexchange.com/a/57909/, a packet sent to 192.168.1.97 "doesn't leave the host but is treated like a packet received from the network, addressed to 192.168.1.97." So same as sending a packet to loop back 127.0.0.1.

why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?

Does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

$ nmap -p0-65535 10.44.104.250



Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT

Nmap scan report for ocean (10.44.104.250)

Host is up (0.00039s latency).

Not shown: 65532 closed ports

PORT      STATE SERVICE

22/tcp    open  ssh

111/tcp   open  rpcbind

3306/tcp  open  mysql

33060/tcp open  mysqlx



Nmap done: 1 IP address (1 host up) scanned in 9.55 seconds



$ nmap -p0-65535 localhost



Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT

Nmap scan report for localhost (127.0.0.1)

Host is up (0.00033s latency).

Other addresses for localhost (not scanned):

Not shown: 65529 closed ports

PORT      STATE SERVICE

22/tcp    open  ssh

111/tcp   open  rpcbind

631/tcp   open  ipp

3306/tcp  open  mysql

5432/tcp  open  postgresql

9050/tcp  open  tor-socks

33060/tcp open  mysqlx



Nmap done: 1 IP address (1 host up) scanned in 5.39 seconds

Thanks.

No, a service listening to a port on an external interface does not necessarily also listen on that port on localhost.

You can test this with something like

nc -l external-ip-address port-number

Then run nmap against localhost, then against the external IP address.

In short, they are two different interfaces (192.168.1.97 vs 127.0.0.1), and may have different firewall rules applied and/or services listening. Being on the same machine means relatively little.

why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?

Because to improve security many services are configured by default to only listen on 127.0.0.1 (and/or the IPv6 equivilent ::1)

Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

No

Generally a service can create a listening socket to listen on.

1. A specific IP, such a listening socket will only accept traffic destined for that specific IP.


2. 0.0.0.0 , this will accept traffic to all IPv4 IPs assigned to the machine.


3. :: this will accept traffic to all IPv6 IPs assigned to the machine. It may or may not accept traffic destined to IPv4 IPs on the machine depending on the particular OS, system wide configuration and socket-specific options.