Skip to content
SPECIFICTION
Get listed

scanlogd

openwall.com

Free plan LinuxSelf-hosted
Visit openwall.com
Spec score 7.4 #22 of 39 in Intrusion Detection and Prevention Software

What it is

scanlogd is a free TCP port scan detection tool for Linux and self-hosted deployments. It captures packets through Linux raw sockets, libnids, or libpcap. The project advises against using libpcap alone when fragmented IP packets matter, recommending libnids for non-Linux systems or monitoring an entire network. The official download page lists release 2.2.8, release files and signatures, an Openwall archive, and source browsing through GitHub. scanlogd is listed in Owl, Debian GNU/Linux, Gentoo Linux, ALT Linux, and OpenWrt, with ports in OpenBSD and FreeBSD collections. A contributed precompiled Win32 build is also linked. The project describes scanlogd as designed to be totally safe to use and points readers to its manual page and a Phrack article. Openwall offers commercial configuration, compilation, and installation support at US $250/hour with a six-hour minimum or US $9,000/week; fixed-price quotes are available for sufficiently specific projects.

Spec sheet

Purpose
scanlogd is a TCP port scan detection tool.Read 9 Oct 2026 · openwall.com
Capture interfaces
It supports Linux raw sockets, libnids, and libpcap for packet capture.Read 9 Oct 2026 · openwall.com
Commercial support
Openwall says commercial support is available to help configure, compile, and install scanlogd and its third-party raw IP networking libraries.Read 9 Oct 2026 · openwall.com
Distribution availability
The page says scanlogd is part of Owl, Debian GNU/Linux, Gentoo Linux, ALT Linux distributions, and OpenWrt.Read 9 Oct 2026 · openwall.com
Documentation
The page recommends reading the scanlogd(8) manual page and the original Phrack Magazine article.Read 9 Oct 2026 · openwall.com
Fragmented packets
The project discourages using libpcap alone and recommends libnids for non-Linux systems or monitoring an entire network, to handle fragmented IP packets.Read 9 Oct 2026 · openwall.com
Latest release
The official page lists scanlogd 2.2.8 as the release available for download.Read 9 Oct 2026 · openwall.com
Ports
The page also lists scanlogd ports in the OpenBSD and FreeBSD ports collections.Read 9 Oct 2026 · openwall.com
Release compatibility
The 2.2.8 announcement says the release avoids recent glibc deprecation warnings while retaining support for older glibc and non-Linux systems.Read 9 Oct 2026 · openwall.com
Safety
The project says scanlogd is designed to be totally safe to use.Read 9 Oct 2026 · openwall.com
Source and signatures
The page provides release files and signatures, links to an Openwall file archive, and says the source code can be browsed on GitHub.Read 9 Oct 2026 · openwall.com
Support pricing
Openwall lists service pricing as US $250/hour with a 6-hour minimum, or US $9,000/week, and says fixed-price quotes are available for sufficiently specific projects.Read 9 Oct 2026 · openwall.com
Windows build
The page links to a contributed scanlogd 2.2 pre-compiled for Win32.Read 9 Oct 2026 · openwall.com

Plans and prices

scanlogd Free No price stated · commercial support available by quote Read 9 Oct 2026 · openwall.com

Every scanlogd plan and price →

Strong points and limits

Strong points

  • Free plan
  • Supports Linux raw sockets, libnids, and libpcap
  • Detects TCP port scans
  • Available through several Linux distributions
  • Source and signatures are provided

Limits

  • Linux is the listed supported platform
  • libpcap alone is discouraged for fragmented packets
  • No inline blocking
  • Commercial support has paid minimums

Who it suits

It suits Linux or self-hosted users who need TCP port-scan detection and packet-capture choices. Teams needing installation or configuration help can use Openwall’s commercial support.

Verdict

scanlogd provides focused TCP port-scan detection with several capture interfaces and broad distribution availability. Check packet-fragmentation requirements and platform fit before deployment.

Where Specifiction places it

Alternatives to scanlogdAll alternatives →