Freedom251 › Intrusion Detection and Prevention Software
scanlogd
What scanlogd is
scanlogd is a TCP port scan detection tool for Linux and self-hosted use. It captures packets through Linux raw sockets, libnids, or libpcap. The project cautions that libpcap alone is not the preferred choice where fragmented IP packets need handling; it recommends libnids for non-Linux systems or monitoring a whole network. The official page lists scanlogd 2.2.8 for download, alongside release files and signatures, and links to an Openwall archive and source code on GitHub. The project lists the tool as included in Owl, Debian GNU/Linux, Gentoo Linux, ALT Linux, and OpenWrt, and as available in the OpenBSD and FreeBSD ports collections. A contributed precompiled Win32 build is also linked. The project describes scanlogd as designed to be safe to use and recommends its manual page and an original Phrack Magazine article for documentation. Commercial support is available for configuration, compilation, and installation help. Published support rates are US $250/hour with a six-hour minimum or US $9,000/week; fixed-price quotes may be available for sufficiently specific projects.
Who it suits
scanlogd suits Linux users seeking TCP port scan detection, including those deploying it in self-hosted environments.
What it does well
- Supports raw sockets, libnids, and libpcap capture.
- Release files and signatures are provided.
- Listed in several Linux distributions and OpenWrt.
- Commercial configuration and installation support is available.
What to know first
- The official page lists release 2.2.8.
- The project advises against libpcap alone for fragmented packets.
- Commercial support rates start at US $250/hour with a six-hour minimum.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| scanlogd | No price stated · commercial support available by quote | Free |
As openwall.com lists them, read 9 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the scanlogd website.
- Download release 2.2.8 and its files or signatures, or use a listed distribution package or ports collection.
- Choose Linux raw sockets, libnids, or libpcap for packet capture; the project recommends libnids where fragmented IP packets need handling.
- Read the scanlogd(8) manual page and the original Phrack Magazine article.
- Contact Openwall for commercial configuration, compilation, or installation support if needed.
Verdict
scanlogd is a focused TCP port scan detection tool with several packet-capture options and distribution listings. Readers monitoring fragmented traffic should note the project’s guidance on capture methods.
Questions
Is scanlogd free?
Yes. Its pricing model is free, with a free plan.
What platforms does scanlogd support?
Linux is the supported platform, and the deployment model is self-hosted. The page also links a contributed precompiled Win32 build and lists OpenBSD and FreeBSD ports.
Which packet capture methods does it support?
It supports Linux raw sockets, libnids, and libpcap. For fragmented IP packets, the project discourages relying on libpcap alone and recommends libnids for non-Linux systems or whole-network monitoring.
What is the current listed release?
The official page lists scanlogd 2.2.8 for download. Its announcement says it avoids recent glibc deprecation warnings while supporting older glibc and non-Linux systems.
How much does commercial support cost?
Openwall lists US $250/hour with a 6-hour minimum, or US $9,000/week. Fixed-price quotes are available for sufficiently specific projects.
Where can I find the source and documentation?
The page provides release files and signatures, links to an Openwall file archive, and links to browse the source on GitHub. It recommends the scanlogd(8) manual page and an original Phrack Magazine article.
Facts from scanlogd's own pages
- Capture interfaces
- It supports Linux raw sockets, libnids, and libpcap for packet capture. · openwall.com, 9 Oct 2026
- Commercial support
- Openwall says commercial support is available to help configure, compile, and install scanlogd and its third-party raw IP networking libraries. · openwall.com, 9 Oct 2026
- Distribution availability
- The page says scanlogd is part of Owl, Debian GNU/Linux, Gentoo Linux, ALT Linux distributions, and OpenWrt. · openwall.com, 9 Oct 2026
- Documentation
- The page recommends reading the scanlogd(8) manual page and the original Phrack Magazine article. · openwall.com, 9 Oct 2026
- Fragmented packets
- The project discourages using libpcap alone and recommends libnids for non-Linux systems or monitoring an entire network, to handle fragmented IP packets. · openwall.com, 9 Oct 2026
- Latest release
- The official page lists scanlogd 2.2.8 as the release available for download. · openwall.com, 9 Oct 2026
- Ports
- The page also lists scanlogd ports in the OpenBSD and FreeBSD ports collections. · openwall.com, 9 Oct 2026
- Purpose
- scanlogd is a TCP port scan detection tool. · openwall.com, 9 Oct 2026
- Release compatibility
- The 2.2.8 announcement says the release avoids recent glibc deprecation warnings while retaining support for older glibc and non-Linux systems. · openwall.com, 9 Oct 2026
- Safety
- The project says scanlogd is designed to be totally safe to use. · openwall.com, 9 Oct 2026
- Source and signatures
- The page provides release files and signatures, links to an Openwall file archive, and says the source code can be browsed on GitHub. · openwall.com, 9 Oct 2026
- Support pricing
- Openwall lists service pricing as US $250/hour with a 6-hour minimum, or US $9,000/week, and says fixed-price quotes are available for sufficiently specific projects. · openwall.com, 9 Oct 2026
- Windows build
- The page links to a contributed scanlogd 2.2 pre-compiled for Win32. · openwall.com, 9 Oct 2026