Does `nmap -p0-65535 0.0.0.0` scan all the IP addresses on the local host?

Question

Does nmap -p0-65535 0.0.0.0 scan all the tcp ports on any of the IP addresses on the local host, so report services listening at the tcp ports at any of the local IP addresses including 192.168.1.97 and 127.0.0.1?

$ nmap -p0-65535 0.0.0.0

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-24 17:48 EDT
Nmap scan report for 0.0.0.0
Host is up (0.00066s latency).
Not shown: 65529 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
111/tcp   open  rpcbind
631/tcp   open  ipp
3306/tcp  open  mysql
5432/tcp  open  postgresql
9050/tcp  open  tor-socks
33060/tcp open  mysqlx

Nmap done: 1 IP address (1 host up) scanned in 5.40 seconds

seems to output a union of

$ nmap -p0-65535 localhost

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-24 17:48 EDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00033s latency).
Other addresses for localhost (not scanned):
Not shown: 65529 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
111/tcp   open  rpcbind
631/tcp   open  ipp
3306/tcp  open  mysql
5432/tcp  open  postgresql
9050/tcp  open  tor-socks
33060/tcp open  mysqlx

and

Nmap done: 1 IP address (1 host up) scanned in 4.50 seconds

$ nmap -p0-65535 192.168.1.97

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-24 17:49 EDT
Nmap scan report for ocean.fios-router.home (192.168.1.97)
Host is up (0.00036s latency).
Not shown: 65532 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
111/tcp   open  rpcbind
3306/tcp  open  mysql
33060/tcp open  mysqlx

Thanks.

Answer 1

No. When nmap does scan multiple IP addresses, it shows separate port lists. It does not merge results from different IP addresses. Compare the result of nmap 127.0.0.1-2 (or nmap 127.0.0.1 127.0.0.2).

nmap 0.0.0.0 is equivalent to nmap 127.0.0.1 . At least for the software you are using.

---

Please remember that when you run nmap as the root user, it uses a different scan method by default. For example, this is what allows it to scan "port 0". However when not run as root, "Nmap asks the underlying operating system to establish a connection with the target machine and port by issuing the connect system call".

The point being, I forgot that difference :-), so I went and traced the operating system you use i.e. Linux. I've looked at this before, haha. This behaviour is not part of the official documentation for Linux. In general you should prefer to use 127.0.0.1, which is documented and standard on all implementations of IPv4.

You can trace tcp_v4_connect through to the specific condition:

if (!fl4->daddr) {
    fl4->daddr = fl4->saddr;
    if (!fl4->daddr)
        fl4->daddr = fl4->saddr = htonl(INADDR_LOOPBACK);
    dev_out = net->loopback_dev;
    fl4->flowi4_oif = LOOPBACK_IFINDEX;
    res->type = RTN_LOCAL;
    flags |= RTCF_LOCAL;
    goto make_route;
}

This suggests that on Linux, nmap -sT 0.0.0.0 is equivalent to nmap -sT 127.0.0.1.

Additionally, nmap -sT 0.0.0.0 -S 192.168.1.97 would be equivalent to nmap -sT 192.168.1.97 :-). (Assuming your IP address is 192.168.1.97). If you have read this far, you may as well try it yourself :-).

Again, when running as root the default scan type will not use the operating system call connect() to connect to each TCP port. Instead, nmap will "send and receive raw TCP packets". So you are entirely relying on the nmap code to generate packets and make its own decisions. It is possible that nmap will not generate the same packets as the OS would. So sudo nmap 0.0.0.0 -S 192.168.1.97 might not give the same results as sudo nmap 192.168.1.97. It might do though. I don't know, I haven't tried it.