and come to think of it scanning against "localhost" will only show services that are listening on the loopback interface, and miss anything that's specifically bound to a real network interface. To get an accurate view of how the outside world sees your server you should run nmap against it from some other machine.