scanlogd
What it is
scanlogd is a free TCP port scan detection tool for Linux and self-hosted deployments. It captures traffic through Linux raw sockets, libnids, or libpcap. The project advises against relying on libpcap alone when fragmented IP packets matter, recommending libnids for non-Linux systems or monitoring a complete network. The official site lists version 2.2.8 for download, with release files, signatures, an Openwall archive, and source browsing through GitHub. scanlogd is listed in Owl, Debian GNU/Linux, Gentoo Linux, ALT Linux, and OpenWrt, with ports in OpenBSD and FreeBSD collections. A contributed Win32 build is also linked. The project describes the software as designed to be totally safe and points readers to its manual page and an original Phrack article. Openwall offers commercial configuration, compilation, and installation support at US $250/hour with a six-hour minimum or US $9,000/week; fixed-price quotes may be available.
For and against
For
- Free plan available
- Supports raw sockets, libnids, and libpcap
- Source and release signatures provided
- Available through several Linux distributions
- Designed to be safe to use
Against
- Linux-focused supported platform
- libpcap alone is discouraged for fragmented packets
- Commercial support has a six-hour minimum
The verdict
scanlogd provides focused TCP port scan detection with several packet-capture options and broad distribution availability. Its deployment is self-hosted, and packet-fragment handling may require libnids rather than libpcap alone.
Who it suits
It suits Linux administrators and self-hosted operators who need TCP port scan detection. Users working with fragmented packets should consider the project’s libnids guidance.
Plans and prices
scanlogd
No price stated · commercial support available by quote
Read 9 Oct 2026 · openwall.com
On the record
- Capture interfaces
- It supports Linux raw sockets, libnids, and libpcap for packet capture.openwall.com · read 9 Oct 2026
- Commercial support
- Openwall says commercial support is available to help configure, compile, and install scanlogd and its third-party raw IP networking libraries.openwall.com · read 9 Oct 2026
- Distribution availability
- The page says scanlogd is part of Owl, Debian GNU/Linux, Gentoo Linux, ALT Linux distributions, and OpenWrt.openwall.com · read 9 Oct 2026
- Documentation
- The page recommends reading the scanlogd(8) manual page and the original Phrack Magazine article.openwall.com · read 9 Oct 2026
- Fragmented packets
- The project discourages using libpcap alone and recommends libnids for non-Linux systems or monitoring an entire network, to handle fragmented IP packets.openwall.com · read 9 Oct 2026
- Latest release
- The official page lists scanlogd 2.2.8 as the release available for download.openwall.com · read 9 Oct 2026
- Ports
- The page also lists scanlogd ports in the OpenBSD and FreeBSD ports collections.openwall.com · read 9 Oct 2026
- Purpose
- scanlogd is a TCP port scan detection tool.openwall.com · read 9 Oct 2026
- Release compatibility
- The 2.2.8 announcement says the release avoids recent glibc deprecation warnings while retaining support for older glibc and non-Linux systems.openwall.com · read 9 Oct 2026
- Safety
- The project says scanlogd is designed to be totally safe to use.openwall.com · read 9 Oct 2026
- Source and signatures
- The page provides release files and signatures, links to an Openwall file archive, and says the source code can be browsed on GitHub.openwall.com · read 9 Oct 2026
- Support pricing
- Openwall lists service pricing as US $250/hour with a 6-hour minimum, or US $9,000/week, and says fixed-price quotes are available for sufficiently specific projects.openwall.com · read 9 Oct 2026
- Windows build
- The page links to a contributed scanlogd 2.2 pre-compiled for Win32.openwall.com · read 9 Oct 2026
