Is there a firewall in place?

[Derek Fountain <dflists () iinet net au>]

Is it possible to tell if a machine you're port scanning is protected by a 
firewall of some sort? That is, to tell if the scan is checking the ports 
open and passed through a firewall, or whether the scan is scanning the 
actual machine? The machine in question is running W2K, although nmap's OS 
detection fails to confirm that.

Are there any tell tale signs that there's a filtering box in the way?