scanlogd review
Free Linux software for detecting and logging TCP port scans, not blocking them.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
For administrators who need port-scan events recorded, scanlogd is a free, open-source tool for Linux. It monitors raw IP packets, detects TCP port scans, and writes scan events to syslog. It can be used on a host or, with an appropriate capture setup, across a directly connected network segment. Its narrow purpose suits Linux users who want scan logging; it is not a general-purpose intrusion prevention system.
Packet capture can use Linux raw sockets, or scanlogd can be built with libnids or libpcap support. Detected scans are summarized in log messages. When scans arrive at a high rate, the tool temporarily stops logging, which is a specific behavior to consider when evaluating how its logs fit into monitoring workflows. Syslog is the listed logging integration, while libnids and libpcap are build options rather than broad platform integrations.
The key boundary is detection versus response: scanlogd records scans but does not block them. Its open-source pricing model makes it a no-cost option, and its deployment is self-hosted on Linux. Documentation is the listed support channel. Choose it if the requirement is straightforward TCP port-scan logging and the surrounding environment can handle any response to detected activity. Look elsewhere if inline blocking or broader intrusion prevention is essential; scanlogd's scope is deliberately limited to identifying and recording scans.
scanlogd pros and cons
- Where it wins
- Detects TCP port scans and summarizes them in log messages
- Writes scan events to syslog
- Supports packet capture with Linux raw sockets, libnids, or libpcap
- Where it doesn't
- Detects and logs scans but does not prevent them
- Available for Linux only
- Focused on TCP port-scan detection rather than broader intrusion prevention
scanlogd fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update