Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
PSAD detects port scans and other suspicious traffic by analyzing messages generated by an iptables firewall. Install it on the VPS, make sure denied traffic reaches a logging rule, point PSAD at the system’s firewall log, and then tune its alert thresholds. Detection works only on packets your firewall logs; a restrictive ruleset that silently drops traffic gives PSAD no evidence to analyze.
This guide covers Debian and Ubuntu installations, firewall-rule ordering, log locations, configuration, safe verification, false-positive handling, and the risks of automatic blocking. The examples assume a VPS you own or are authorized to administer and test.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat PSAD does and how detection works
PSAD is a set of lightweight daemons that watches iptables log messages. It classifies port scans, reports suspicious traffic, and can optionally add firewall blocks when configured to do so. Its primary input is not a packet capture: it is the kernel firewall log produced by iptables.
The detector examines TCP flags to identify scan styles such as SYN, FIN, and XMAS scans. It also uses TCP, UDP, and ICMP signatures derived from Snort to recognize probes associated with backdoors, denial-of-service tools, operating-system fingerprinting, and related activity. An alert can contain the source address, packet count, scanned port range, danger level, reverse-DNS information, and WHOIS data.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Because PSAD analyzes traffic that the firewall has already dropped, a detected scan was unsuccessful at the firewall boundary. That is useful evidence of an intrusion attempt, not proof that an attacker reached an application or logged in.
Requirements before installation
- A Debian or Ubuntu VPS with administrative access. The package is available through the distribution repositories on systems where the package metadata includes it.
- iptables rules that log traffic which is not explicitly allowed. PSAD cannot infer a scan from packets that never produce a firewall log message.
- A known location for kernel firewall messages. PSAD’s documented default is
/var/log/messages, but syslog or rsyslog configuration can send those messages elsewhere. - Authorization to generate test traffic. Only scan systems and addresses you own or are expressly permitted to assess.
Install PSAD on Debian or Ubuntu
Install the repository package
Refresh package metadata and install PSAD:
sudo apt-get update
sudo apt-get install psadThe update command is normal repository maintenance; the documented PSAD package command is apt-get install psad. The package installs the PSAD daemons and service integration. After installation, start the distribution-provided service with the VPS image’s normal init or systemd tooling, then use the package’s status and alert views to confirm that the daemons are running. A single service command is not prescribed here because service integration and command names differ between distribution releases.
If the package is unavailable
The PSAD project README provides a bundled install.pl script that can install or upgrade PSAD and its Perl dependencies. Use that documented installer only after checking the script and its prerequisites on the target VPS; mixing repository files with a source installation can make later upgrades and service ownership harder to understand.
Make iptables generate evidence PSAD can read
Put logging after allowed traffic
Arrange the rules so established connections and explicitly permitted services are handled first. Traffic that does not match those decisions should reach a logging rule and then the final deny action. This prevents routine accepted traffic from dominating the evidence while still recording probes aimed at closed or unapproved ports.
The project README illustrates the basic logging actions:
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
iptables -A INPUT -j LOG
iptables -A FORWARD -j LOGThese broad examples are demonstrations, not a complete VPS policy. Adapt them to the services, interfaces, and forwarding behavior on your machine. If the ruleset already logs a packet in an earlier chain and logs it again later, one probe can create multiple messages and inflate PSAD’s counts.
Use a distinctive log prefix when useful
An iptables LOG rule can include a prefix so that a dedicated audit path is easy to identify. PSAD can search every iptables message, or restrict matching to prefixes configured in FW_MSG_SEARCH. Choose one approach deliberately: a prefix that is never written produces no detections, while searching all messages can include unrelated firewall logs.
Check both input and forwarding paths
Internet-facing VPS services normally use the INPUT chain. A VPS acting as a router, gateway, or container host may also need FORWARD logging. Log only the paths that reflect your policy; forwarding rules that are not used by the host add noise without improving visibility.
Confirm the log source and PSAD ingestion
PSAD reads iptables log data from /var/log/messages by default according to its manual. Many Debian and Ubuntu installations route kernel messages through a different file or journal, so inspect the active syslog or rsyslog configuration and identify where firewall messages actually appear. Do not change PSAD’s input setting until you know which file receives the LOG entries.
When an expected alert is missing, follow the path in order:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- Verify that the packet matched the intended LOG rule rather than an earlier ACCEPT or a silent DROP.
- Verify that a new firewall message appeared in the configured log source.
- Check that PSAD is running and watching that source.
- Check whether the message prefix is excluded by your search settings.
- Review thresholds and ignore lists before concluding that detection failed.
The firewall message is the decisive diagnostic artifact. If no message exists, PSAD has nothing to parse.
Analyze existing logs without waiting for a new scan
PSAD can process historical data with -A (also written as --Analyze-msgs) and then exit. The --messages-file option selects the file to analyze. For example, analyze a copy or an archived file while tuning:
sudo psad -A --messages-file /var/log/messagesHistorical analysis is useful when PSAD was installed after an incident or when you want to test a threshold change without generating new traffic. Use a copy when you need to preserve an original log for separate review.
Configure /etc/psad/psad.conf
The normal configuration file is /etc/psad/psad.conf. The -c option selects an alternative file when you need a separate configuration for testing or a nonstandard layout. Values shown below are defaults in the packaged configuration, not universal settings for every VPS.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Setting | Documented default | Purpose | Practical tuning decision |
|---|---|---|---|
FW_SEARCH_ALL |
Y |
Parses all iptables messages. | Set to N when matching must be limited to prefixes listed in FW_MSG_SEARCH. |
FW_MSG_SEARCH |
DROP |
Search string used when matching is restricted. | Add the exact prefix emitted by your firewall if your LOG rules do not contain the default text. |
| Danger thresholds | 5, 15, 150, 1500, and 10000 packets for levels 1–5 | Packet-count boundaries used to assign danger levels. | Establish a normal baseline first; lower values increase sensitivity and noise, while higher values delay escalation. |
CHECK_INTERVAL |
5 seconds |
Polling interval for checking new messages. | Keep the default unless the VPS workload and response requirements justify a different interval. |
PORT_RANGE_SCAN_THRESHOLD |
1 |
Minimum scanned-port range used for an alert. | Adjust only after observing how legitimate service checks appear in your logs. |
ENABLE_PERSISTENCE |
Y |
Keeps long-running scan data from timing out by default. | Retain persistence when slow, distributed probing matters to your investigation. |
ALERTING_METHODS |
ALL |
Enables the documented syslog and email reporting modes. | Choose reporting channels that someone actually monitors and configure the VPS mail path if email is required. |
IGNORE_PORTS |
not stated | Excludes selected ports from consideration. | Use for known benign sequences, such as an approved port-knocking design, only after confirming the traffic’s origin. |
IGNORE_INTERFACES |
not stated | Excludes traffic arriving through selected interfaces. | Useful when a trusted internal or management interface produces expected probes. |
IGNORE_LOG_PREFIXES |
not stated | Excludes messages with selected prefixes. | Use for dedicated audit or health-check prefixes that are known not to represent hostile scans. |
Choose a sensible tuning process
Begin with the packaged values and observe ordinary traffic. Record which addresses, ports, interfaces, and prefixes create alerts during health checks, monitoring, port knocking, or approved internal scans. Add an ignore rule only when the source and behavior are understood; broad exclusions can hide a real probe. Then revisit the danger thresholds and port-range setting using historical analysis before changing production behavior.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Verify detection with an authorized test
Use a controlled scan from a system you own or administer. The test objective is to confirm the complete chain, not to measure PSAD’s performance.
- Confirm that PSAD’s daemons are running and that the firewall policy is loaded.
- From the authorized test host, generate a modest probe against the VPS address and only the ports permitted by your test plan.
- Confirm a corresponding iptables LOG entry in the actual kernel-message file.
- Check the PSAD alert view and reporting channel.
- Confirm that the alert identifies the source address, packet count, scanned port range, scan type or matching signature, and danger level.
- Afterward, classify the event as expected test traffic and ensure it does not lead to an unintended block.
If the firewall entry exists but the alert lacks useful details, inspect the message format, prefix matching, and threshold values. If the alert appears but the source or port range is unexpected, investigate NAT, forwarding, or another device that may be generating the traffic.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Understand alerts and control false positives
A danger level is a classification based on observed evidence and configured thresholds; it is not a statement that compromise occurred. A low-level event may be a single rejected connection, while repeated probes can move through the documented packet-count boundaries. The level should guide triage rather than replace examination of the source, destination ports, timing, and signature.
Common benign causes include uptime checks, vulnerability scanners operated by your organization, port-knocking sequences, and internal monitoring. Use IGNORE_PORTS, IGNORE_INTERFACES, or IGNORE_LOG_PREFIXES narrowly for traffic you have verified. Keep the original firewall visibility for everything else so an exclusion does not become a blind spot.
Decide whether to enable automatic blocking
ENABLE_AUTO_IDS is N in the documented configuration, so PSAD alerts without changing firewall policy by default. Leave it disabled while you validate log quality, thresholds, and false-positive handling.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
The manual warns that spoofed packets can make an innocent, well-known address appear to be scanning. Automatic blocking could then deny legitimate access. PSAD also evaluates packets the firewall has already dropped, so blocking an apparent scanner is a response action rather than a way to stop the packet that generated the original event.
Safeguards for a controlled rollout
- Maintain an allowlist for trusted administration and monitoring networks before enabling any automated response.
- Review the rules PSAD generates and confirm that they have the expected scope and lifetime.
- Define a recovery path that does not depend on the blocked address, such as an independent management network or console access.
- Use the manual’s commands for listing, adding, and removing PSAD-managed firewall blocks, and document the change before applying it.
- Start with a narrow, observable policy and reassess it after reviewing real alerts.
Detection and response should be evaluated separately. A reliable alert stream is useful even when automatic blocking is never enabled.
Troubleshoot the most common failures
No alerts after a known test
- Look for the firewall LOG message first. A final DROP without logging cannot be analyzed.
- Confirm that the message is in the file PSAD reads, rather than only in a journal or another syslog file.
- Check
FW_SEARCH_ALLandFW_MSG_SEARCH. A custom prefix must match exactly when search is restricted. - Check whether the event is below the configured port-range or danger threshold.
- Confirm that the PSAD daemons are running and that the service has loaded the configuration you edited.
Too many alerts
- Identify whether accepted health checks or monitoring traffic is being logged alongside denied traffic.
- Remove duplicate LOG rules that record the same packet more than once.
- Use the narrow ignore settings for verified benign ports, interfaces, or prefixes.
- Raise thresholds only after examining historical logs; a high threshold can hide slow scans.
Historical analysis gives different results
Ensure you analyzed the same message file and configuration used by the daemon. Rotated files, altered prefixes, and different threshold values can legitimately change the classification. Use psad -A --messages-file against a preserved copy when comparing two tuning choices.
Know PSAD’s deployment boundaries
PSAD is centered on iptables log messages. When choosing it for a particular VPS image, verify how that image handles IPv4, IPv6, and nftables. The cited PSAD documentation establishes the iptables-centered design but does not establish current native nftables support. A host whose active firewall never emits compatible iptables messages may require a different detector or a deliberately maintained compatibility layer.
For a comparison with another host intrusion detector, evaluate the integration required with the firewall and logging stack, TCP/UDP/ICMP scan and signature coverage, alert channels, historical-log analysis, tuning controls, IPv4 and IPv6 behavior, nftables compatibility, resource use, and whether response actions are alert-only or can modify firewall rules. These criteria expose operational differences more clearly than a feature-count list.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsOperational review after deployment
Recheck the installation whenever the firewall policy, syslog routing, service interfaces, or VPS image changes. Confirm that approved services still precede the logging-and-deny path, that the expected log file continues to receive kernel firewall messages, and that alerts reach a monitored channel. Periodically review persistence data, ignored sources, danger-level distributions, and any automatically managed blocks. Keep automatic response disabled unless those reviews and a tested rollback path justify enabling it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
