scanlogd
scanlogd is a tool for detecting TCP port scans, intended for Linux and self-hosted use.
What scanlogd is
scanlogd is a tool for detecting TCP port scans, intended for Linux and self-hosted use. It captures packets through Linux raw sockets, libnids, or libpcap. The project advises against relying on libpcap alone when fragmented IP packets need handling; it recommends libnids for non-Linux systems or monitoring an entire network. The official page lists scanlogd 2.2.8 for download and provides release files and signatures, with links to an Openwall archive and source code on GitHub. The project lists the tool in Owl, Debian GNU/Linux, Gentoo Linux, ALT Linux, and OpenWrt, and in the OpenBSD and FreeBSD ports collections. It also links to a contributed precompiled Win32 build. The project describes scanlogd as designed to be safe to use and recommends reading its manual page and an original Phrack Magazine article. Commercial support is available for help configuring, compiling, and installing the tool and third-party raw IP networking libraries. Listed support rates are US $250/hour with a six-hour minimum or US $9,000/week; fixed-price quotes may be available for sufficiently specific projects.
Good
- Free scan detection software
- Supports raw sockets, libnids, and libpcap
- Listed in several Linux distributions
- Release files and signatures are available
Watch out
- libpcap alone is discouraged for fragmented packets
- Commercial support starts at US $250/hour with a six-hour minimum
- Linux is the listed platform
Who it suits
scanlogd suits administrators looking for a Linux or self-hosted TCP port scan detection tool. Those needing help with setup can inquire about commercial support.
Verdict
scanlogd provides packet-capture options for TCP port scan detection and is included in several distributions. Take note of the guidance on fragmented packets when choosing a capture method.
Plans and prices
From scanlogd's own pricing page, checked 9 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| scanlogd | Free | No price stated · commercial support available by quote |
The facts
Each one read from scanlogd's own pages, with the date it was checked.
What it does
- Capture interfaces
- It supports Linux raw sockets, libnids, and libpcap for packet capture.checked 9 Oct 2026
- Commercial support
- Openwall says commercial support is available to help configure, compile, and install scanlogd and its third-party raw IP networking libraries.checked 9 Oct 2026
- Distribution availability
- The page says scanlogd is part of Owl, Debian GNU/Linux, Gentoo Linux, ALT Linux distributions, and OpenWrt.checked 9 Oct 2026
- Documentation
- The page recommends reading the scanlogd(8) manual page and the original Phrack Magazine article.checked 9 Oct 2026
- Fragmented packets
- The project discourages using libpcap alone and recommends libnids for non-Linux systems or monitoring an entire network, to handle fragmented IP packets.checked 9 Oct 2026
- Latest release
- The official page lists scanlogd 2.2.8 as the release available for download.checked 9 Oct 2026
- Ports
- The page also lists scanlogd ports in the OpenBSD and FreeBSD ports collections.checked 9 Oct 2026
- Purpose
- scanlogd is a TCP port scan detection tool.checked 9 Oct 2026
- Release compatibility
- The 2.2.8 announcement says the release avoids recent glibc deprecation warnings while retaining support for older glibc and non-Linux systems.checked 9 Oct 2026
- Safety
- The project says scanlogd is designed to be totally safe to use.checked 9 Oct 2026
- Source and signatures
- The page provides release files and signatures, links to an Openwall file archive, and says the source code can be browsed on GitHub.checked 9 Oct 2026
- Support pricing
- Openwall lists service pricing as US $250/hour with a 6-hour minimum, or US $9,000/week, and says fixed-price quotes are available for sufficiently specific projects.checked 9 Oct 2026
Where it runs
- Windows build
- The page links to a contributed scanlogd 2.2 pre-compiled for Win32.checked 9 Oct 2026
Alternatives to scanlogd
- 1
OPNsense
Free planOpen sourceAndroidiOSWebAPI8.6Free plan - 2
CrowdSec
Free planOpen sourceiOSWebAPIExtension8.5From $49 a month - 3
Wazuh
Free planOpen sourceWebAPILinuxmacOS8.4From $571 a month - 4
IPFire
Free planOpen sourceWebAPILinuxSelf-hosted8.0From $1,099 a year - 5
OSSEC
Free planOpen sourceAPILinuxmacOSSelf-hosted8.0From $55 a year - 6
Arista NG Firewall
Free planWeb7.5Free plan