why `nmap 192.168.1.97` returns less services than `nmap 127.0.0.1`? [duplicate]












6
















This question already has an answer here:




  • Difference between `nmap local-IP-address` and `nmap localhost`

    3 answers




According to https://networkengineering.stackexchange.com/a/57909/, a packet sent to 192.168.1.97 "doesn't leave the host but is treated like a packet received from the network, addressed to 192.168.1.97." So same as sending a packet to loop back 127.0.0.1.



why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?



Does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?



$ nmap -p0-65535 192.168.1.97

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for ocean (192.168.1.97)
Host is up (0.00039s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
3306/tcp open mysql
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 9.55 seconds

$ nmap -p0-65535 localhost

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00033s latency).
Other addresses for localhost (not scanned):
Not shown: 65529 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
631/tcp open ipp
3306/tcp open mysql
5432/tcp open postgresql
9050/tcp open tor-socks
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 5.39 seconds


Thanks.










share|improve this question















marked as duplicate by Jeff Schaller, Michael Homer, Stephen Harris, jimmij, Gilles yesterday


This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.



















  • Because not all services are listening on the external interface?

    – Kusalananda
    2 days ago











  • Seems to me that Rui's Answer there applies here.

    – Jeff Schaller
    2 days ago











  • @Kusalananda In particular, does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – Tim
    2 days ago













  • They're different addresses, why would a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – 炸鱼薯条德里克
    2 days ago











  • Somehow, I don't think the other guy on Network Engineering answered correctly. When you specify an ip address to send packet, it would have to go to router to be . . . routed, duh. But localhost would be resolved to 127.0.0.1 just like 127.0.0.1 itself would be understood as loopback.

    – Sergiy Kolodyazhnyy
    2 days ago
















6
















This question already has an answer here:




  • Difference between `nmap local-IP-address` and `nmap localhost`

    3 answers




According to https://networkengineering.stackexchange.com/a/57909/, a packet sent to 192.168.1.97 "doesn't leave the host but is treated like a packet received from the network, addressed to 192.168.1.97." So same as sending a packet to loop back 127.0.0.1.



why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?



Does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?



$ nmap -p0-65535 192.168.1.97

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for ocean (192.168.1.97)
Host is up (0.00039s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
3306/tcp open mysql
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 9.55 seconds

$ nmap -p0-65535 localhost

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00033s latency).
Other addresses for localhost (not scanned):
Not shown: 65529 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
631/tcp open ipp
3306/tcp open mysql
5432/tcp open postgresql
9050/tcp open tor-socks
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 5.39 seconds


Thanks.










share|improve this question















marked as duplicate by Jeff Schaller, Michael Homer, Stephen Harris, jimmij, Gilles yesterday


This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.



















  • Because not all services are listening on the external interface?

    – Kusalananda
    2 days ago











  • Seems to me that Rui's Answer there applies here.

    – Jeff Schaller
    2 days ago











  • @Kusalananda In particular, does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – Tim
    2 days ago













  • They're different addresses, why would a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – 炸鱼薯条德里克
    2 days ago











  • Somehow, I don't think the other guy on Network Engineering answered correctly. When you specify an ip address to send packet, it would have to go to router to be . . . routed, duh. But localhost would be resolved to 127.0.0.1 just like 127.0.0.1 itself would be understood as loopback.

    – Sergiy Kolodyazhnyy
    2 days ago














6












6








6









This question already has an answer here:




  • Difference between `nmap local-IP-address` and `nmap localhost`

    3 answers




According to https://networkengineering.stackexchange.com/a/57909/, a packet sent to 192.168.1.97 "doesn't leave the host but is treated like a packet received from the network, addressed to 192.168.1.97." So same as sending a packet to loop back 127.0.0.1.



why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?



Does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?



$ nmap -p0-65535 192.168.1.97

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for ocean (192.168.1.97)
Host is up (0.00039s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
3306/tcp open mysql
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 9.55 seconds

$ nmap -p0-65535 localhost

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00033s latency).
Other addresses for localhost (not scanned):
Not shown: 65529 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
631/tcp open ipp
3306/tcp open mysql
5432/tcp open postgresql
9050/tcp open tor-socks
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 5.39 seconds


Thanks.










share|improve this question

















This question already has an answer here:




  • Difference between `nmap local-IP-address` and `nmap localhost`

    3 answers




According to https://networkengineering.stackexchange.com/a/57909/, a packet sent to 192.168.1.97 "doesn't leave the host but is treated like a packet received from the network, addressed to 192.168.1.97." So same as sending a packet to loop back 127.0.0.1.



why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?



Does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?



$ nmap -p0-65535 192.168.1.97

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for ocean (192.168.1.97)
Host is up (0.00039s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
3306/tcp open mysql
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 9.55 seconds

$ nmap -p0-65535 localhost

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-23 19:18 EDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00033s latency).
Other addresses for localhost (not scanned):
Not shown: 65529 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
631/tcp open ipp
3306/tcp open mysql
5432/tcp open postgresql
9050/tcp open tor-socks
33060/tcp open mysqlx

Nmap done: 1 IP address (1 host up) scanned in 5.39 seconds


Thanks.





This question already has an answer here:




  • Difference between `nmap local-IP-address` and `nmap localhost`

    3 answers








nmap ip-address loopback






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited yesterday







Tim

















asked 2 days ago









TimTim

28.1k78269490




28.1k78269490




marked as duplicate by Jeff Schaller, Michael Homer, Stephen Harris, jimmij, Gilles yesterday


This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.









marked as duplicate by Jeff Schaller, Michael Homer, Stephen Harris, jimmij, Gilles yesterday


This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.















  • Because not all services are listening on the external interface?

    – Kusalananda
    2 days ago











  • Seems to me that Rui's Answer there applies here.

    – Jeff Schaller
    2 days ago











  • @Kusalananda In particular, does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – Tim
    2 days ago













  • They're different addresses, why would a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – 炸鱼薯条德里克
    2 days ago











  • Somehow, I don't think the other guy on Network Engineering answered correctly. When you specify an ip address to send packet, it would have to go to router to be . . . routed, duh. But localhost would be resolved to 127.0.0.1 just like 127.0.0.1 itself would be understood as loopback.

    – Sergiy Kolodyazhnyy
    2 days ago



















  • Because not all services are listening on the external interface?

    – Kusalananda
    2 days ago











  • Seems to me that Rui's Answer there applies here.

    – Jeff Schaller
    2 days ago











  • @Kusalananda In particular, does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – Tim
    2 days ago













  • They're different addresses, why would a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

    – 炸鱼薯条德里克
    2 days ago











  • Somehow, I don't think the other guy on Network Engineering answered correctly. When you specify an ip address to send packet, it would have to go to router to be . . . routed, duh. But localhost would be resolved to 127.0.0.1 just like 127.0.0.1 itself would be understood as loopback.

    – Sergiy Kolodyazhnyy
    2 days ago

















Because not all services are listening on the external interface?

– Kusalananda
2 days ago





Because not all services are listening on the external interface?

– Kusalananda
2 days ago













Seems to me that Rui's Answer there applies here.

– Jeff Schaller
2 days ago





Seems to me that Rui's Answer there applies here.

– Jeff Schaller
2 days ago













@Kusalananda In particular, does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

– Tim
2 days ago







@Kusalananda In particular, does nmap 127.0.0.1 necessarily also return those services returned by nmap 192.168.1.97? Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

– Tim
2 days ago















They're different addresses, why would a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

– 炸鱼薯条德里克
2 days ago





They're different addresses, why would a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

– 炸鱼薯条德里克
2 days ago













Somehow, I don't think the other guy on Network Engineering answered correctly. When you specify an ip address to send packet, it would have to go to router to be . . . routed, duh. But localhost would be resolved to 127.0.0.1 just like 127.0.0.1 itself would be understood as loopback.

– Sergiy Kolodyazhnyy
2 days ago





Somehow, I don't think the other guy on Network Engineering answered correctly. When you specify an ip address to send packet, it would have to go to router to be . . . routed, duh. But localhost would be resolved to 127.0.0.1 just like 127.0.0.1 itself would be understood as loopback.

– Sergiy Kolodyazhnyy
2 days ago










4 Answers
4






active

oldest

votes


















8














In short, they are two different interfaces (192.168.1.97 vs 127.0.0.1), and may have different firewall rules applied and/or services listening. Being on the same machine means relatively little.






share|improve this answer
























  • Thanks. Does nmap -p0-65535 0.0.0.0 scan all the IP addresses on the local host, and report services listening at ports at all these IP addresses including 192.168.1.97 and 127.0.0.1?

    – Tim
    yesterday











  • No. It scans only a single IP address, 0.0.0.0. Which is not really a valid host IP.

    – John
    yesterday



















7














No, a service listening to a port on an external interface does not necessarily also listen on that port on localhost.



You can test this with something like



nc -l external-ip-address port-number


Then run nmap against localhost, then against the external IP address.






share|improve this answer
























  • Thanks. What do you mean by an "external interface"? What is an "internal interface"? The IP address 192.168.1.97 in my post is private (internal), not public (external).

    – Tim
    yesterday













  • @Tim By "external" interface, I meant "an interface that is accessible from the outside", as opposed to an internal interface, the loopback interface. I believe I might have used the terms quite loosely to differentiate externally available services (services listening to an address that is externally visible) and services only available on 127.0.0.1.

    – Kusalananda
    yesterday



















6















why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?




Because to improve security many services are configured by default to only listen on 127.0.0.1 (and/or the IPv6 equivilent ::1)




Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?




No



Generally a service can create a listening socket to listen on.




  1. A specific IP, such a listening socket will only accept traffic destined for that specific IP.

  2. 0.0.0.0 , this will accept traffic to all IPv4 IPs assigned to the machine.

  3. :: this will accept traffic to all IPv6 IPs assigned to the machine. It may or may not accept traffic destined to IPv4 IPs on the machine depending on the particular OS, system wide configuration and socket-specific options.






share|improve this answer































    2














    The 127-type of address is internal only, as per RFC1122:




    Internal host loopback address. Addresses of this form
    MUST NOT appear outside a host.




    This means that those services are listening locally. The 192.168.1.97 is your public-facing address, and that's how router and other computers know you. The 127.0.0.1/8 in a sense is a "simulation" of a network. You can test things with it, you can run local services on and exchange packets between them - essentially same things as you'd do with an actual internet resource. In fact, that's what web developers do: they set up local environment and run XAMP or LAMP stack locally before moving on to production environment when polished product will actually face the internet.



    Now, it should not happen that you receive a packet from 127.x.x.x type of address on public facing interface like eth0 or wlan0. If that happens, this is called Martian packet, and it's likely that someone is trying to attack your host or network.



    In a certain sense you could make it an analogy between your router and your computer. On LAN, your router has 192.168.1.0 address, but to the internet it is known as 68.125.xx.yy ( disclamer: random example, not an actual IP address intended here ). The router might expose to the internet only port 53 ( DNS ), but internally you could have port 80 ( HTTP control panel ) and 53. Same idea with your computer.



    Of course, the services would have to be configured to listen on either public or local interface only. For instance, Redis server comes preconfigured to listen only on 127.0.0.1, because security reasons.



    See also




    • What is the difference between 0.0.0.0 and a loopback IP address?

    • Wikipedia's article about localhost






    share|improve this answer






























      4 Answers
      4






      active

      oldest

      votes








      4 Answers
      4






      active

      oldest

      votes









      active

      oldest

      votes






      active

      oldest

      votes









      8














      In short, they are two different interfaces (192.168.1.97 vs 127.0.0.1), and may have different firewall rules applied and/or services listening. Being on the same machine means relatively little.






      share|improve this answer
























      • Thanks. Does nmap -p0-65535 0.0.0.0 scan all the IP addresses on the local host, and report services listening at ports at all these IP addresses including 192.168.1.97 and 127.0.0.1?

        – Tim
        yesterday











      • No. It scans only a single IP address, 0.0.0.0. Which is not really a valid host IP.

        – John
        yesterday
















      8














      In short, they are two different interfaces (192.168.1.97 vs 127.0.0.1), and may have different firewall rules applied and/or services listening. Being on the same machine means relatively little.






      share|improve this answer
























      • Thanks. Does nmap -p0-65535 0.0.0.0 scan all the IP addresses on the local host, and report services listening at ports at all these IP addresses including 192.168.1.97 and 127.0.0.1?

        – Tim
        yesterday











      • No. It scans only a single IP address, 0.0.0.0. Which is not really a valid host IP.

        – John
        yesterday














      8












      8








      8







      In short, they are two different interfaces (192.168.1.97 vs 127.0.0.1), and may have different firewall rules applied and/or services listening. Being on the same machine means relatively little.






      share|improve this answer













      In short, they are two different interfaces (192.168.1.97 vs 127.0.0.1), and may have different firewall rules applied and/or services listening. Being on the same machine means relatively little.







      share|improve this answer












      share|improve this answer



      share|improve this answer










      answered 2 days ago









      JohnJohn

      11.8k11931




      11.8k11931













      • Thanks. Does nmap -p0-65535 0.0.0.0 scan all the IP addresses on the local host, and report services listening at ports at all these IP addresses including 192.168.1.97 and 127.0.0.1?

        – Tim
        yesterday











      • No. It scans only a single IP address, 0.0.0.0. Which is not really a valid host IP.

        – John
        yesterday



















      • Thanks. Does nmap -p0-65535 0.0.0.0 scan all the IP addresses on the local host, and report services listening at ports at all these IP addresses including 192.168.1.97 and 127.0.0.1?

        – Tim
        yesterday











      • No. It scans only a single IP address, 0.0.0.0. Which is not really a valid host IP.

        – John
        yesterday

















      Thanks. Does nmap -p0-65535 0.0.0.0 scan all the IP addresses on the local host, and report services listening at ports at all these IP addresses including 192.168.1.97 and 127.0.0.1?

      – Tim
      yesterday





      Thanks. Does nmap -p0-65535 0.0.0.0 scan all the IP addresses on the local host, and report services listening at ports at all these IP addresses including 192.168.1.97 and 127.0.0.1?

      – Tim
      yesterday













      No. It scans only a single IP address, 0.0.0.0. Which is not really a valid host IP.

      – John
      yesterday





      No. It scans only a single IP address, 0.0.0.0. Which is not really a valid host IP.

      – John
      yesterday













      7














      No, a service listening to a port on an external interface does not necessarily also listen on that port on localhost.



      You can test this with something like



      nc -l external-ip-address port-number


      Then run nmap against localhost, then against the external IP address.






      share|improve this answer
























      • Thanks. What do you mean by an "external interface"? What is an "internal interface"? The IP address 192.168.1.97 in my post is private (internal), not public (external).

        – Tim
        yesterday













      • @Tim By "external" interface, I meant "an interface that is accessible from the outside", as opposed to an internal interface, the loopback interface. I believe I might have used the terms quite loosely to differentiate externally available services (services listening to an address that is externally visible) and services only available on 127.0.0.1.

        – Kusalananda
        yesterday
















      7














      No, a service listening to a port on an external interface does not necessarily also listen on that port on localhost.



      You can test this with something like



      nc -l external-ip-address port-number


      Then run nmap against localhost, then against the external IP address.






      share|improve this answer
























      • Thanks. What do you mean by an "external interface"? What is an "internal interface"? The IP address 192.168.1.97 in my post is private (internal), not public (external).

        – Tim
        yesterday













      • @Tim By "external" interface, I meant "an interface that is accessible from the outside", as opposed to an internal interface, the loopback interface. I believe I might have used the terms quite loosely to differentiate externally available services (services listening to an address that is externally visible) and services only available on 127.0.0.1.

        – Kusalananda
        yesterday














      7












      7








      7







      No, a service listening to a port on an external interface does not necessarily also listen on that port on localhost.



      You can test this with something like



      nc -l external-ip-address port-number


      Then run nmap against localhost, then against the external IP address.






      share|improve this answer













      No, a service listening to a port on an external interface does not necessarily also listen on that port on localhost.



      You can test this with something like



      nc -l external-ip-address port-number


      Then run nmap against localhost, then against the external IP address.







      share|improve this answer












      share|improve this answer



      share|improve this answer










      answered 2 days ago









      KusalanandaKusalananda

      137k17258426




      137k17258426













      • Thanks. What do you mean by an "external interface"? What is an "internal interface"? The IP address 192.168.1.97 in my post is private (internal), not public (external).

        – Tim
        yesterday













      • @Tim By "external" interface, I meant "an interface that is accessible from the outside", as opposed to an internal interface, the loopback interface. I believe I might have used the terms quite loosely to differentiate externally available services (services listening to an address that is externally visible) and services only available on 127.0.0.1.

        – Kusalananda
        yesterday



















      • Thanks. What do you mean by an "external interface"? What is an "internal interface"? The IP address 192.168.1.97 in my post is private (internal), not public (external).

        – Tim
        yesterday













      • @Tim By "external" interface, I meant "an interface that is accessible from the outside", as opposed to an internal interface, the loopback interface. I believe I might have used the terms quite loosely to differentiate externally available services (services listening to an address that is externally visible) and services only available on 127.0.0.1.

        – Kusalananda
        yesterday

















      Thanks. What do you mean by an "external interface"? What is an "internal interface"? The IP address 192.168.1.97 in my post is private (internal), not public (external).

      – Tim
      yesterday







      Thanks. What do you mean by an "external interface"? What is an "internal interface"? The IP address 192.168.1.97 in my post is private (internal), not public (external).

      – Tim
      yesterday















      @Tim By "external" interface, I meant "an interface that is accessible from the outside", as opposed to an internal interface, the loopback interface. I believe I might have used the terms quite loosely to differentiate externally available services (services listening to an address that is externally visible) and services only available on 127.0.0.1.

      – Kusalananda
      yesterday





      @Tim By "external" interface, I meant "an interface that is accessible from the outside", as opposed to an internal interface, the loopback interface. I believe I might have used the terms quite loosely to differentiate externally available services (services listening to an address that is externally visible) and services only available on 127.0.0.1.

      – Kusalananda
      yesterday











      6















      why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?




      Because to improve security many services are configured by default to only listen on 127.0.0.1 (and/or the IPv6 equivilent ::1)




      Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?




      No



      Generally a service can create a listening socket to listen on.




      1. A specific IP, such a listening socket will only accept traffic destined for that specific IP.

      2. 0.0.0.0 , this will accept traffic to all IPv4 IPs assigned to the machine.

      3. :: this will accept traffic to all IPv6 IPs assigned to the machine. It may or may not accept traffic destined to IPv4 IPs on the machine depending on the particular OS, system wide configuration and socket-specific options.






      share|improve this answer




























        6















        why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?




        Because to improve security many services are configured by default to only listen on 127.0.0.1 (and/or the IPv6 equivilent ::1)




        Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?




        No



        Generally a service can create a listening socket to listen on.




        1. A specific IP, such a listening socket will only accept traffic destined for that specific IP.

        2. 0.0.0.0 , this will accept traffic to all IPv4 IPs assigned to the machine.

        3. :: this will accept traffic to all IPv6 IPs assigned to the machine. It may or may not accept traffic destined to IPv4 IPs on the machine depending on the particular OS, system wide configuration and socket-specific options.






        share|improve this answer


























          6












          6








          6








          why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?




          Because to improve security many services are configured by default to only listen on 127.0.0.1 (and/or the IPv6 equivilent ::1)




          Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?




          No



          Generally a service can create a listening socket to listen on.




          1. A specific IP, such a listening socket will only accept traffic destined for that specific IP.

          2. 0.0.0.0 , this will accept traffic to all IPv4 IPs assigned to the machine.

          3. :: this will accept traffic to all IPv6 IPs assigned to the machine. It may or may not accept traffic destined to IPv4 IPs on the machine depending on the particular OS, system wide configuration and socket-specific options.






          share|improve this answer














          why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?




          Because to improve security many services are configured by default to only listen on 127.0.0.1 (and/or the IPv6 equivilent ::1)




          Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?




          No



          Generally a service can create a listening socket to listen on.




          1. A specific IP, such a listening socket will only accept traffic destined for that specific IP.

          2. 0.0.0.0 , this will accept traffic to all IPv4 IPs assigned to the machine.

          3. :: this will accept traffic to all IPv6 IPs assigned to the machine. It may or may not accept traffic destined to IPv4 IPs on the machine depending on the particular OS, system wide configuration and socket-specific options.







          share|improve this answer












          share|improve this answer



          share|improve this answer










          answered 2 days ago









          plugwashplugwash

          1,951619




          1,951619























              2














              The 127-type of address is internal only, as per RFC1122:




              Internal host loopback address. Addresses of this form
              MUST NOT appear outside a host.




              This means that those services are listening locally. The 192.168.1.97 is your public-facing address, and that's how router and other computers know you. The 127.0.0.1/8 in a sense is a "simulation" of a network. You can test things with it, you can run local services on and exchange packets between them - essentially same things as you'd do with an actual internet resource. In fact, that's what web developers do: they set up local environment and run XAMP or LAMP stack locally before moving on to production environment when polished product will actually face the internet.



              Now, it should not happen that you receive a packet from 127.x.x.x type of address on public facing interface like eth0 or wlan0. If that happens, this is called Martian packet, and it's likely that someone is trying to attack your host or network.



              In a certain sense you could make it an analogy between your router and your computer. On LAN, your router has 192.168.1.0 address, but to the internet it is known as 68.125.xx.yy ( disclamer: random example, not an actual IP address intended here ). The router might expose to the internet only port 53 ( DNS ), but internally you could have port 80 ( HTTP control panel ) and 53. Same idea with your computer.



              Of course, the services would have to be configured to listen on either public or local interface only. For instance, Redis server comes preconfigured to listen only on 127.0.0.1, because security reasons.



              See also




              • What is the difference between 0.0.0.0 and a loopback IP address?

              • Wikipedia's article about localhost






              share|improve this answer




























                2














                The 127-type of address is internal only, as per RFC1122:




                Internal host loopback address. Addresses of this form
                MUST NOT appear outside a host.




                This means that those services are listening locally. The 192.168.1.97 is your public-facing address, and that's how router and other computers know you. The 127.0.0.1/8 in a sense is a "simulation" of a network. You can test things with it, you can run local services on and exchange packets between them - essentially same things as you'd do with an actual internet resource. In fact, that's what web developers do: they set up local environment and run XAMP or LAMP stack locally before moving on to production environment when polished product will actually face the internet.



                Now, it should not happen that you receive a packet from 127.x.x.x type of address on public facing interface like eth0 or wlan0. If that happens, this is called Martian packet, and it's likely that someone is trying to attack your host or network.



                In a certain sense you could make it an analogy between your router and your computer. On LAN, your router has 192.168.1.0 address, but to the internet it is known as 68.125.xx.yy ( disclamer: random example, not an actual IP address intended here ). The router might expose to the internet only port 53 ( DNS ), but internally you could have port 80 ( HTTP control panel ) and 53. Same idea with your computer.



                Of course, the services would have to be configured to listen on either public or local interface only. For instance, Redis server comes preconfigured to listen only on 127.0.0.1, because security reasons.



                See also




                • What is the difference between 0.0.0.0 and a loopback IP address?

                • Wikipedia's article about localhost






                share|improve this answer


























                  2












                  2








                  2







                  The 127-type of address is internal only, as per RFC1122:




                  Internal host loopback address. Addresses of this form
                  MUST NOT appear outside a host.




                  This means that those services are listening locally. The 192.168.1.97 is your public-facing address, and that's how router and other computers know you. The 127.0.0.1/8 in a sense is a "simulation" of a network. You can test things with it, you can run local services on and exchange packets between them - essentially same things as you'd do with an actual internet resource. In fact, that's what web developers do: they set up local environment and run XAMP or LAMP stack locally before moving on to production environment when polished product will actually face the internet.



                  Now, it should not happen that you receive a packet from 127.x.x.x type of address on public facing interface like eth0 or wlan0. If that happens, this is called Martian packet, and it's likely that someone is trying to attack your host or network.



                  In a certain sense you could make it an analogy between your router and your computer. On LAN, your router has 192.168.1.0 address, but to the internet it is known as 68.125.xx.yy ( disclamer: random example, not an actual IP address intended here ). The router might expose to the internet only port 53 ( DNS ), but internally you could have port 80 ( HTTP control panel ) and 53. Same idea with your computer.



                  Of course, the services would have to be configured to listen on either public or local interface only. For instance, Redis server comes preconfigured to listen only on 127.0.0.1, because security reasons.



                  See also




                  • What is the difference between 0.0.0.0 and a loopback IP address?

                  • Wikipedia's article about localhost






                  share|improve this answer













                  The 127-type of address is internal only, as per RFC1122:




                  Internal host loopback address. Addresses of this form
                  MUST NOT appear outside a host.




                  This means that those services are listening locally. The 192.168.1.97 is your public-facing address, and that's how router and other computers know you. The 127.0.0.1/8 in a sense is a "simulation" of a network. You can test things with it, you can run local services on and exchange packets between them - essentially same things as you'd do with an actual internet resource. In fact, that's what web developers do: they set up local environment and run XAMP or LAMP stack locally before moving on to production environment when polished product will actually face the internet.



                  Now, it should not happen that you receive a packet from 127.x.x.x type of address on public facing interface like eth0 or wlan0. If that happens, this is called Martian packet, and it's likely that someone is trying to attack your host or network.



                  In a certain sense you could make it an analogy between your router and your computer. On LAN, your router has 192.168.1.0 address, but to the internet it is known as 68.125.xx.yy ( disclamer: random example, not an actual IP address intended here ). The router might expose to the internet only port 53 ( DNS ), but internally you could have port 80 ( HTTP control panel ) and 53. Same idea with your computer.



                  Of course, the services would have to be configured to listen on either public or local interface only. For instance, Redis server comes preconfigured to listen only on 127.0.0.1, because security reasons.



                  See also




                  • What is the difference between 0.0.0.0 and a loopback IP address?

                  • Wikipedia's article about localhost







                  share|improve this answer












                  share|improve this answer



                  share|improve this answer










                  answered 2 days ago









                  Sergiy KolodyazhnyySergiy Kolodyazhnyy

                  10.7k42763




                  10.7k42763















                      Popular posts from this blog

                      Masuk log Menu navigasi

                      Identifying “long and narrow” polygons in with PostGISlength and width of polygonWhy postgis st_overlaps reports Qgis' “avoid intersections” generated polygon as overlapping with others?Adjusting polygons to boundary and filling holesDrawing polygons with fixed area?How to remove spikes in Polygons with PostGISDeleting sliver polygons after difference operation in QGIS?Snapping boundaries in PostGISSplit polygon into parts adding attributes based on underlying polygon in QGISSplitting overlap between polygons and assign to nearest polygon using PostGIS?Expanding polygons and clipping at midpoint?Removing Intersection of Buffers in Same Layers

                      Старые Смолеговицы Содержание История | География | Демография | Достопримечательности | Примечания | НавигацияHGЯOLHGЯOL41 206 832 01641 606 406 141Административно-территориальное деление Ленинградской области«Переписная оброчная книга Водской пятины 1500 года», С. 793«Карта Ингерманландии: Ивангорода, Яма, Копорья, Нотеборга», по материалам 1676 г.«Генеральная карта провинции Ингерманландии» Э. Белинга и А. Андерсина, 1704 г., составлена по материалам 1678 г.«Географический чертёж над Ижорскою землей со своими городами» Адриана Шонбека 1705 г.Новая и достоверная всей Ингерманландии ланткарта. Грав. А. Ростовцев. СПб., 1727 г.Топографическая карта Санкт-Петербургской губернии. 5-и верстка. Шуберт. 1834 г.Описание Санкт-Петербургской губернии по уездам и станамСпецкарта западной части России Ф. Ф. Шуберта. 1844 г.Алфавитный список селений по уездам и станам С.-Петербургской губернииСписки населённых мест Российской Империи, составленные и издаваемые центральным статистическим комитетом министерства внутренних дел. XXXVII. Санкт-Петербургская губерния. По состоянию на 1862 год. СПб. 1864. С. 203Материалы по статистике народного хозяйства в С.-Петербургской губернии. Вып. IX. Частновладельческое хозяйство в Ямбургском уезде. СПб, 1888, С. 146, С. 2, 7, 54Положение о гербе муниципального образования Курское сельское поселениеСправочник истории административно-территориального деления Ленинградской области.Топографическая карта Ленинградской области, квадрат О-35-23-В (Хотыницы), 1930 г.АрхивированоАдминистративно-территориальное деление Ленинградской области. — Л., 1933, С. 27, 198АрхивированоАдминистративно-экономический справочник по Ленинградской области. — Л., 1936, с. 219АрхивированоАдминистративно-территориальное деление Ленинградской области. — Л., 1966, с. 175АрхивированоАдминистративно-территориальное деление Ленинградской области. — Лениздат, 1973, С. 180АрхивированоАдминистративно-территориальное деление Ленинградской области. — Лениздат, 1990, ISBN 5-289-00612-5, С. 38АрхивированоАдминистративно-территориальное деление Ленинградской области. — СПб., 2007, с. 60АрхивированоКоряков Юрий База данных «Этно-языковой состав населённых пунктов России». Ленинградская область.Административно-территориальное деление Ленинградской области. — СПб, 1997, ISBN 5-86153-055-6, С. 41АрхивированоКультовый комплекс Старые Смолеговицы // Электронная энциклопедия ЭрмитажаПроблемы выявления, изучения и сохранения культовых комплексов с каменными крестами: по материалам работ 2016-2017 гг. в Ленинградской области