scanlogd

At a glance

• Editor score
  5.6 / 10
• Pricing
  Free plan
• Best for
  Linux users who need simple port-scan logging
• Free plan
  Yes
• Paid from
  Free
• Inline blocking
  No
• Facts checked
  23 Sep 2026

• Where it wins

  • Detects TCP port scans and summarizes them in log messages
  • Writes scan events to syslog
  • Supports packet capture with Linux raw sockets, libnids, or libpcap

• Where it doesn't

  • Detects and logs scans but does not prevent them
  • Available for Linux only
  • Focused on TCP port-scan detection rather than broader intrusion prevention

Our verdict on scanlogd

For administrators who need port-scan events recorded, scanlogd is a free, open-source tool for Linux. It monitors raw IP packets, detects TCP port scans, and writes scan events to syslog. It can be used on a host or, with an appropriate capture setup, across a directly connected network segment. Its narrow purpose suits Linux users who want scan logging; it is not a general-purpose intrusion prevention system.

Packet capture can use Linux raw sockets, or scanlogd can be built with libnids or libpcap support. Detected scans are summarized in log messages. When scans arrive at a high rate, the tool temporarily stops logging, which is a specific behavior to consider when evaluating how its logs fit into monitoring workflows. Syslog is the listed logging integration, while libnids and libpcap are build options rather than broad platform integrations.

The key boundary is detection versus response: scanlogd records scans but does not block them. Its open-source pricing model makes it a no-cost option, and its deployment is self-hosted on Linux. Documentation is the listed support channel. Choose it if the requirement is straightforward TCP port-scan logging and the surrounding environment can handle any response to detected activity. Look elsewhere if inline blocking or broader intrusion prevention is essential; scanlogd's scope is deliberately limited to identifying and recording scans.

Your product? Our editors can test scanlogd in depth and publish a review, labelled as paid · from $149/mo →

scanlogd pricing

scanlogd fact sheet

scanlogd integrations

scanlogd lists 3 integrations on its own site.

• syslog
• libnids
• libpcap

Alternatives to scanlogd

• SuricataA capable free network IDS and IPS for teams prepared to manage self-hosted deployment.9.3
• Palo Alto Networks Advanced Threat PreventionA strong fit for Palo Alto environments needing inline zero-day and exploit prevention.9.1
• CPCheck Point Intrusion Prevention System (IPS)Enterprise IPS combining signature, behavioral, and virtual patching defenses.8.9

See all scanlogd alternatives →

Featured on iTechGuides

scanlogd is listed in our Intrusion Detection and Prevention Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/scanlogd/"><img src="https://www.itechguides.com/best/badge/scanlogd.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update