Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running scanlogd to detect port scans. I have observed the following to generate a log message in /var/log/syslog.

  • When I use zenmap (nmap gui) to port scan this system from another computer on the same subnet
  • Using nmap to scan the system from the loalhost using destination as
  • Using nmap to scan the system from the loalhost using the external IP as the destination.
  • From my phone on a different subnet in the same organization (A University).


Aug 16 15:38:59 LIVE272675 scanlogd: to ports 22, 17500, 256, 135, 143, 113, 53, ..., ?????uxy, TOS 00 @14:57:26
Aug 16 15:40:20 LIVE272675 scanlogd: to ports 6010, 6011, 48153, 49681, 52321, 33819, 60076, ..., ?????uxy, TOS 00, TTL 64 @16:24:06
Aug 16 15:41:13 LIVE272675 scanlogd: to ports 80, 443, 993, 143, 256, 1720, 8080, 1723, ..., fSrpauxy, TOS 00, TTL 64 @20:41:13
Aug 16 15:49:07 LIVE272675 scanlogd: to ports 1, 2, 3, 7, 9, 11, ..., fSrpauxy, TOS 00, TTL 63 @20:49:07

However, scanning this machine from a machine outside the organization network did not generate any logs, even though the scans detected the ports that were open and the services that were running on the system correctly. Have I got some settings wrong? Or is this something that is expected?

Why is scanlogd missing the scans? Is there a way to detect all port scans?

share|improve this question
Is there a network firewall? Is it only permitting connections to legitimate services? If you run tcpdump on your host during the scan, do you see the traffic you expect? – larsks Aug 17 '13 at 1:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.