SCANLOGD(8)

💅 SCANLOGD — the manual page, but make it make sense

okay bestie so real talk, scanlogd lives in section 8 of the manual (that's the "system administration" girlies, the root-only zone 🔥) and it's genuinely iconic. let's get into it.

---

✨ NAME ✨

scanlogd — she detects and logs TCP port scans 🕵️♀️💖

---

🎀 SYNOPSIS 🎀

scanlogd

that's it. no flags, no args, no drama. she just is. periodt.

---

🦋 DESCRIPTION 🦋

so like. scanlogd detects port scans and writes one line per scan via the syslog(3) mechanism. that's her whole thing and she eats every time 💅

if a single source address sends multiple packets to different ports in a short time, the event gets logged. like, she notices. she always notices 👀

the format of the messages is:

saddr[:sport] to daddr [and others,] ports port[, port...], ..., flags[, TOS TOS][, TTL TTL] @HH:MM:SS

the fields in square brackets are optional — that's the "only if she feels like it" section 🎀. specifically, sport, TOS, and TTL will only be displayed if they were constant during the scan. if they were jumping around the whole time, no shade, they just don't get a spot in the lineup.

the flags field represents TCP control bits seen in packets coming to the system from the address of the scan. it's a combination of eight characters, each one corresponding to one of the six defined and two reserved TCP control bits (see RFC 793, she's old but she's famous).

here's the encoding tea ☕:

• control bits that were always set → an uppercase letter
• a lowercase letter → the bit was always clear
• a question mark → the bit changed from packet to packet (flaky behavior, we've all been there 😭)

---

🌈 INTERFACES 🌈

to do her job, scanlogd needs a way to obtain raw IP packets that either:

• come to the system scanlogd is running on, or
• travel across a network segment that is directly connected to the system

current versions of scanlogd can be built with support for one of several packet capture interfaces. pick your fighter 💖

scanlogd is aware of:

• the raw socket interface on Linux
• libnids
• libpcap

the use of libpcap alone is discouraged. if you're on a system other than Linux and/or want to monitor the traffic of an entire network at once, you should be using libnids in order to handle fragmented IP packets. don't be stubborn bestie, just use libnids.

---

⭐ COMPILE-TIME DEFAULTS ⭐

these are the numbers she was built with, no cap:

• at least 7 different privileged ports or 21 non-privileged ports, or a weighted combination of those, have to be accessed with no longer than 3 seconds between the accesses to be treated as a scan. three seconds. that's the window. be quick about it.
• if more than 5 scans are detected within 20 seconds, that event will be logged and logging will be stopped temporarily. she needs a lil break, she's only human 🫶
• logging is done with a facility of daemon and a priority level alert.
• scanlogd should be started as root since it needs access to a packet capture interface.
• by default, it chroots to /var/empty and switches to running as user scanlogd after the packet capture interface is initialized. queen of security hygiene, honestly 👑

---

💀 EXIT STATUS 💀

if the daemon couldn't start up successfully, it will exit with a status of 1. that's the "nope, not today" code.

---

🍓 USAGE 🍓

you're expected to create a dummy user for scanlogd to run as. make sure you allocate unique UID and GID to the user — don't be reusing IDs, that's messy 💅

in most cases, scanlogd should be started from a rc.d script on system startup. set it and forget it, she'll be there 🦋

in /etc/syslog.conf you may use something like:

daemon.alert   /var/log/alert

and boom, alerts go to that file. iconic.

---

🔥 SECURITY NOTES 🔥

as the name indicates, scanlogd only logs port scans. it does not prevent them. so don't come for her when the scan still happens — she's a journalist, not a bouncer 📝

you will only receive summarized information in the system's log. that's the deal.

obviously, the source address of port scans can be spoofed. don't take any action against the source of attacks unless other evidence is available. seriously. do not. i'm not kidding 😭

sometimes IP addresses are shared between many people — this is the case for:

• ISP shell servers
• dynamic dialup pools
• corporate networks behind NAT (masquerading)

so like, that "attacker" might be a whole office building of innocent people. vibe check before you act, bestie 🙈

---

😭 BUGS 😭

due to the nature of port scans, both are possible:

• false positives — detecting a scan when there isn't one
• false negatives — not detecting a scan when there's one

in particular, false positives occur when many small files are transferred rapidly with passive mode FTP. so if your FTP is going feral, that's why she's yelling. it's not you. it's kind of you, actually. but it's fine 💀

---

👑 AUTHORS 👑

• Solar Designer <solar at openwall.com>
• Steffen Dettmer <steffen at dett.de> wrote the initial version of this manual page 🎀

---

🌸 SEE ALSO 🌸

• syslog(3)
• syslog.conf(5)
• libnids(3)
• pcap(3)
• scanlogd home page: http://www.openwall.com/scanlogd/
• Phrack Magazine, issue 53, article 13

---

and that's the whole page, bestie!! this one came straight from the Openwall Project and it's dated 2 June 2004 — old but absolutely still serving looks ✨ go log some scans, stay safe, don't chroot-shame, and remember: she logs, she doesn't prevent. mwah 💋