Configure psad: Detecting Port Scans on Linux

What psad Does

psad — the Port Scan Attack Detector — analyses iptables or nftables log messages to identify port scans and other suspicious network activity. When it detects a scan pattern, it can alert you by email, log the event, and optionally add a firewall rule to block the offender.

It works by watching for packets logged by the kernel's netfilter framework. If your firewall silently drops packets without logging them, psad sees nothing. The first step is always ensuring your firewall logs dropped packets.

Installing psad

On Ubuntu:

sudo apt update
sudo apt install psad

During installation, the package asks for an email address for alerts and a hostname for identification. You can reconfigure these later.

Verify it is running:

sudo systemctl status psad

Configuring iptables to Log Drops

psad needs iptables to log dropped and rejected packets. Add logging rules at the end of your INPUT and FORWARD chains, before the final DROP:

sudo iptables -A INPUT -j LOG --log-prefix "iptables: " --log-level 4
sudo iptables -A FORWARD -j LOG --log-prefix "iptables: " --log-level 4

If you use UFW (Uncomplicated Firewall), it already logs blocked packets to /var/log/kern.log by default. Verify:

sudo ufw status verbose

Look for Logging: on (low) or higher. If logging is off:

sudo ufw logging on

With nftables

If you use nftables directly, add a log rule before your drop rule:

nft add rule inet filter input log prefix "nftables: " counter drop

psad reads from syslog regardless of the firewall backend — it watches for the log prefix in the messages.

Core Configuration

The main configuration file is /etc/psad/psad.conf. The key settings:

sudo nano /etc/psad/psad.conf

Essential Parameters

EMAIL_ADDRESSES     admin@example.com;
HOSTNAME            your-server;
HOME_NET            192.168.1.0/24;
EXTERNAL_NET        any;

• EMAIL_ADDRESSES — where alerts go. Separate multiple addresses with semicolons.
• HOSTNAME — identifies this server in alerts.
• HOME_NET — your trusted network. psad analyses traffic to this network. Set this to your server's subnet or any for a public-facing server.
• EXTERNAL_NET — leave as any unless you want to restrict scan detection to specific source ranges.

Detection Thresholds

DANGER_LEVEL1       5;
DANGER_LEVEL2       15;
DANGER_LEVEL3       150;
DANGER_LEVEL4       1500;
DANGER_LEVEL5       10000;

These set the number of packets from a single source that trigger each danger level. The defaults are reasonable. Lower them if you want more aggressive detection on a lightly trafficked server.

Timing

CHECK_INTERVAL      5;
SCAN_TIMEOUT        3600;

• CHECK_INTERVAL — how often (in seconds) psad checks for new log data. Five seconds is the default and works well.
• SCAN_TIMEOUT — how long (in seconds) to track a source before resetting its packet count. One hour (3600) is sensible.

Log Source

IPT_SYSLOG_FILE     /var/log/syslog;

On Ubuntu 22.04+ with systemd-journald, you may need:

IPT_SYSLOG_FILE     /var/log/kern.log;

If using UFW, the logs appear in /var/log/ufw.log. Set:

IPT_SYSLOG_FILE     /var/log/ufw.log;

Signature Updates

psad ships with Snort-compatible signatures for identifying specific scan types. Update them:

sudo psad --sig-update
sudo psad -H

The -H flag restarts psad after the update. Schedule regular updates via cron:

sudo crontab -e

Add:

0 4 * * 0 /usr/sbin/psad --sig-update && /usr/sbin/psad -H

This updates signatures every Sunday at 04:00 UTC.

Automatic Blocking

psad can automatically add iptables rules to block scanners. This is powerful but potentially dangerous — a false positive blocks legitimate traffic.

Enable Auto-Blocking

In psad.conf:

ENABLE_AUTO_IDS         Y;
AUTO_IDS_DANGER_LEVEL   3;
AUTO_BLOCK_TIMEOUT      3600;

• ENABLE_AUTO_IDS — enables automatic blocking.
• AUTO_IDS_DANGER_LEVEL — the minimum danger level that triggers a block. Level 3 (150 packets) is conservative. Set to 2 for more aggressive blocking.
• AUTO_BLOCK_TIMEOUT — how long (in seconds) the block persists. 3600 = one hour.

Whitelist Trusted IPs

Critical: whitelist your management IPs before enabling auto-blocking. Edit /etc/psad/auto_dl:

127.0.0.1       0;
your.management.ip  0;

A danger level of 0 means psad will never block these addresses regardless of activity.

Also add trusted networks:

192.168.1.0/24  0;
10.0.0.0/8      0;

Testing Auto-Blocking

Before relying on auto-blocking in production, test it from a non-essential IP:

nmap -sS -p 1-1000 your-server-ip

Watch psad's response:

sudo psad --Status

If your test IP gets blocked, the auto-blocking is working. Unblock it:

sudo psad --fw-rm-block-ip your.test.ip

Reading psad Output

Status

sudo psad --Status

This shows:

• Top attackers by packet count
• Danger levels assigned to each source
• Signature matches (specific scan types identified)
• Current firewall blocks (if auto-blocking is enabled)

Detailed Information

sudo psad --Status --status-summary

For a specific IP:

sudo psad --Analyze --analysis-fields src:192.0.2.100

Integrating with Fail2Ban

psad and Fail2Ban complement each other. Fail2Ban watches application logs (SSH, Apache, etc.) for authentication failures. psad watches network logs for scan patterns. Running both provides coverage at two different layers.

Ensure they do not conflict:

• Whitelist Fail2Ban's loopback traffic in psad: add 127.0.0.1 0; to /etc/psad/auto_dl (already done above).
• Both tools manipulate iptables. On modern Ubuntu, use nftables as the backend for both to avoid rule conflicts.

Hardening psad

Restrict File Permissions

sudo chmod 600 /etc/psad/psad.conf
sudo chmod 600 /etc/psad/auto_dl

Log Rotation

Ensure psad logs rotate. Check /etc/logrotate.d/psad:

/var/log/psad/*.log {
    weekly
    rotate 12
    compress
    delaycompress
    missingok
    notifempty
}

Limit Email Volume

On a busy server, psad can generate a flood of alerts. Set:

EMAIL_LIMIT         50;
EMAIL_ALERT_DANGER_LEVEL  2;

This sends at most 50 emails per scanning source and only for danger level 2 or above.

Verifying the Configuration

After editing psad.conf, restart and verify:

sudo psad -R
sudo psad --Status

Check that psad is reading the correct log file:

sudo psad --fw-analyze

This analyses the current firewall rules and confirms psad can see logged packets. If it reports no logged packets, your iptables logging rules are missing or pointing at the wrong log file.

Summary

Install psad, configure iptables or UFW to log dropped packets, set your HOME_NET and email alerts, update signatures on a schedule, and enable auto-blocking only after whitelisting your management IPs. Pair it with Fail2Ban for layered detection — psad catches the scans, Fail2Ban catches the break-in attempts that follow.