why `nmap 192.168.1.97` returns less services than `nmap 127.0.0.1`?

In short, they are two different interfaces (192.168.1.97 vs 127.0.0.1), and may have different firewall rules applied and/or services listening. Being on the same machine means relatively little.


No, a service listening to a port on an external interface does not necessarily also listen on that port on localhost.

You can test this with something like

nc -l external-ip-address port-number

Then run nmap against localhost, then against the external IP address.


why does nmap 127.0.0.1 return more services than nmap 192.168.1.97?

Because to improve security many services are configured by default to only listen on 127.0.0.1 (and/or the IPv6 equivilent ::1)

Does a server listening at 192.168.1.97 necessarily also listen at 127.0.0.1?

No

Generally a service can create a listening socket to listen on.

  1. A specific IP, such a listening socket will only accept traffic destined for that specific IP.
  2. 0.0.0.0 , this will accept traffic to all IPv4 IPs assigned to the machine.
  3. :: this will accept traffic to all IPv6 IPs assigned to the machine. It may or may not accept traffic destined to IPv4 IPs on the machine depending on the particular OS, system wide configuration and socket-specific options.