Nmap’s Proxy Option Does Not Cover Every Scan Phase
Read the scope of Nmap proxy support before assuming that every discovery, scanning, and lookup operation uses the configured exit.
Nmap's documented proxy support applies through nsock, not to every network operation in the invocation:
| Activity | Documented scope |
|---|---|
| NSE and version scanning | Among the supported uses described by that networking path. |
| Ping, port scanning and OS discovery | Explicitly outside the option's coverage. |
| Hostname resolution | Check the installed version's own limitations; do not infer remote DNS from one proxied exchange. |
A relayed TCP connection is different from ICMP or a specially formed IP packet. An HTTP tunnel cannot carry arbitrary raw-packet operations merely because they share a target address.
A socket-interception wrapper has its own scope. Intercepting ordinary application calls does not establish coverage for raw packets, helper processes or all resolver paths.
For an authorized assessment where source location matters, document the intended route for each enabled phase. If the program cannot provide that routing, use a controlled assessment host with the required placement. A working proxy transaction proves only its own path.