PSAD

• PSAD detects port scans and can block attacking hosts by dynamically updating iptables / ipchains rulesets

• Runs as a collection of four lightweight system daemons (Perl, C)

• Can leverage snort rules to detect highly suspect scans (2.4 kernel only)

• Features a set of highly-configurable danger thresholds and verbose alerts