PSAD detects port scans and other suspicious traffic by analyzing messages that iptables writes to the system log. On a Debian or Ubuntu VPS, the dependable workflow is to install PSAD, make sure denied traffic reaches an iptables LOG rule, confirm PSAD is reading the correct log file, tune its thresholds, and validate alerts with an authorized test. Leave automatic blocking disabled until you have reviewed false positives and prepared a recovery path.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What PSAD detects—and what it cannot see
PSAD (Port Scan Attack Detector) is a set of lightweight daemons that consumes firewall log messages. It classifies scans from TCP flag patterns, including SYN, FIN and XMAS scans, and compares TCP, UDP and ICMP traffic with signatures derived from Snort. Those signatures can identify probes associated with backdoors, denial-of-service tools, operating-system fingerprinting and related activity.
As an Amazon Associate I earn from qualifying purchases.
An alert can include the apparent source address, packet count, scanned port range, danger level, reverse-DNS information and WHOIS data. The detector is therefore useful for answering “what reached the firewall?” rather than “what process on the server made this connection?”
PSAD has a strict visibility boundary: it only analyzes packets that your firewall logs. A packet that is accepted without logging, or dropped before it reaches a LOG rule, leaves no evidence for PSAD. The PSAD project README states that its quality depends on the logging rules in the iptables ruleset. PSAD also analyzes traffic after the firewall has dropped it, so a scan shown in an alert was unsuccessful at that firewall boundary; the alert does not prove that an application was compromised.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Prerequisites and design decisions
- Supported firewall path: The documented design is centered on
iptableslog messages. If the VPS image uses nftables directly, verify how its compatibility layer and logging reach the file PSAD reads; the cited PSAD documentation does not establish current native nftables support. - Administrative access: You need root or
sudoprivileges to install the package, inspect firewall rules and adjust/etc/psad/psad.conf. - A known logging destination: The man page gives
/var/log/messagesas PSAD’s default input, but rsyslog and other syslog configurations can write kernel firewall messages elsewhere. Identify the actual file on your distribution before troubleshooting alerts. - A recovery channel: Keep an existing console, out-of-band terminal or provider recovery method available before changing firewall rules. A mistaken deny rule can otherwise lock you out of the VPS.
- An authorized test source: Any scan used for validation must originate from a system you own or are explicitly authorized to test. Do not scan unrelated hosts.
Install PSAD on Debian or Ubuntu
Refresh the package index and install the distribution package:
sudo apt-get update
sudo apt-get install psadThe PSAD project documents apt-get install psad as the package command. The update step is normal repository maintenance, not a PSAD-specific requirement. The package installs the PSAD daemons and service integration. If the package is unavailable in your image, the project README describes a bundled install.pl script that can install or upgrade PSAD and its Perl dependencies; review that script’s requirements before using it on a production server.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
After installation, start the distribution’s PSAD service and check its status with the init or systemd tooling provided by that VPS image. Service command names differ between distributions and package revisions, so use the service unit or init integration actually installed on your system rather than copying a command intended for another release.
Make iptables generate evidence PSAD can consume
PSAD cannot infer a scan from packets that never produce a log entry. Your firewall policy should therefore have this order:
- Preserve established traffic and explicitly allow the services that must be reachable.
- Send traffic that is not allowed to a LOG rule (or a dedicated logging chain).
- Drop or reject that traffic after logging.
The PSAD README illustrates broad logging rules:
iptables -A INPUT -j LOG
iptables -A FORWARD -j LOGThose examples are not a complete VPS firewall. A broad rule can create substantial log volume, duplicate messages and obscure useful events. Adapt the placement to your policy so legitimate accepted traffic is not logged as a threat and the final deny path is logged before the packet is discarded. If you use a dedicated log prefix, configure PSAD to search for that exact prefix through FW_MSG_SEARCH when you disable its all-message search mode.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Check both the input and forwarding paths that matter to your VPS. A single-host VPS normally receives Internet traffic through INPUT; a server forwarding traffic for other networks may also need an appropriate FORWARD rule. Do not add a forwarding logger merely because it appears in an example—log only paths your policy actually uses.
Confirm the log file and PSAD’s view of it
PSAD reads iptables log data from /var/log/messages by default according to its man page. Many Debian and Ubuntu installations route kernel messages to another file, rotate them, or send them to a central collector. Verify the destination by creating one controlled, denied event and checking which local file receives the corresponding kernel firewall message. Then ensure the PSAD configuration points to that location if it is not the default.
When an alert is missing, follow the evidence chain in this order:
- Did the packet match the intended firewall path?
- Did a LOG rule run before the drop or reject action?
- Did the message appear in the file PSAD is configured to read?
- Does the message contain the prefix or format selected by your PSAD search settings?
- Has the daemon processed the message yet, given the configured polling interval?
This sequence separates firewall, syslog and PSAD problems instead of treating every missing alert as a detector failure.
Start PSAD and inspect alerts
Use the service integration installed with the package to start the daemons, then use the package’s normal status and alert views to confirm that they are running. The exact service command is distribution-specific, so rely on the unit or init script present on the VPS.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
An alert should provide enough context to investigate: source address, packet count, scanned-port range, scan classification or matching signature, danger level and, when available, reverse-DNS and WHOIS information. Treat reverse-DNS names as clues, not identity proof; spoofed source addresses and shared infrastructure can make attribution uncertain.
Compare an alert with the original firewall line. The log confirms what the kernel saw and which rule generated the event; the PSAD alert adds aggregation, classification and severity. Preserve both when escalating an incident.
Tune /etc/psad/psad.conf deliberately
The packaged configuration normally lives at /etc/psad/psad.conf. Use the -c option when you need PSAD to read a different configuration file. The following settings are documented defaults, not universal recommendations:
| Setting | Documented default or role | When to change it |
|---|---|---|
FW_SEARCH_ALL |
Y; parse all iptables messages |
Set to N when you want matching limited to prefixes listed in FW_MSG_SEARCH. |
FW_MSG_SEARCH |
DROP is the documented default search string |
Add the exact prefix used by your firewall when a dedicated logging chain or prefix is used. |
| Danger thresholds | Levels 1–5 default at 5, 15, 150, 1,500 and 10,000 packets | Adjust only after observing normal traffic and deciding what alert volume your operations team can investigate. |
CHECK_INTERVAL |
5 seconds |
Change if your response process needs a different polling cadence and the resulting load is acceptable. |
PORT_RANGE_SCAN_THRESHOLD |
1; minimum scanned-port range used for an alert |
Raise it only when narrow, known-benign checks create noise you have verified. |
ENABLE_PERSISTENCE |
Y; keeps long-running scan data from timing out by default |
Review retention behavior if your traffic volume or operational policy requires a different treatment of long-lived observations. |
ALERTING_METHODS |
ALL; enables documented syslog and email reporting modes |
Choose reporting channels that are monitored and deliverable from the VPS. |
IGNORE_PORTS |
Excludes selected ports from consideration | Use for verified benign sequences such as an approved port-knocking design. |
IGNORE_INTERFACES |
Excludes selected interfaces | Use when a trusted interface carries traffic that should not be evaluated by this detector. |
IGNORE_LOG_PREFIXES |
Excludes selected firewall log prefixes | Use to suppress a known audit or health-check prefix without disabling analysis of other firewall messages. |
Begin with the defaults and collect a baseline. Health checks, monitoring systems, internal scanners and port-knocking sequences can look like reconnaissance. Record which source, ports and schedule produce each benign event, then add the narrowest applicable ignore rule. Avoid broad exclusions that hide unrelated scans.
Thresholds describe packet evidence, not attacker intent. A low-volume probe can still be important, while a high count from a busy monitoring system may be harmless. Use danger levels to prioritize investigation, not as an automatic verdict.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Validate detection with an authorized test
Validation should prove the complete path from packet to alert without touching systems you do not control.
- Confirm installation: Verify that the PSAD package and daemons are present and that the service reports a running state.
- Confirm the deny path: Inspect the active
iptablesrules and identify the LOG action that precedes the final drop or reject for unsolicited traffic. - Choose a test source: Use a host you own or have written authorization to test. Record its address and the exact time window.
- Run a controlled scan: Generate a modest probe against the VPS, staying within the authorization and rate limits for the environment.
- Check the firewall file: Find the matching kernel log line and confirm that the expected chain and prefix were used.
- Check PSAD: Confirm that the alert identifies the test source, ports or range, a scan type or signature when one is recognized, and a danger level.
- Clean up: Remove temporary test rules, retain only the logging policy you intend to operate, and document the result.
If the firewall line exists but no alert appears, inspect the configured message file, search mode and polling interval. If no firewall line exists, adjust the rule order or logging destination before changing PSAD thresholds.
Recommended Free Tools
Analyze scans recorded before installation
PSAD can process historical data instead of waiting for new traffic. Its -A (also written --Analyze-msgs) mode analyzes an iptables log file and exits. Use --messages-file to select a particular file, such as a rotated log or a copy made for testing.
psad -A --messages-file /path/to/iptables-logRun historical analysis against a copy when possible. It lets you evaluate how the current thresholds classify known events, test a proposed ignore prefix and review older scans without altering the live daemon’s input. Preserve the original timestamps and lines so that conclusions remain tied to the traffic that actually occurred.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Automatic blocking: keep response separate from detection
ENABLE_AUTO_IDS is N in the documented configuration, so PSAD does not automatically block sources by default. That default is appropriate while you establish alert quality. Detection tells you that logged traffic resembles a scan; blocking changes the firewall and can affect legitimate users.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
The PSAD man page documents commands to list, add and remove automatically managed firewall blocks. Learn those commands on a staging VPS first, and record the generated rule format so an operator can remove a mistaken block quickly.
Free tools Windows power users keep installed
One-click scans. No signup required.
There is a specific safety problem: spoofed packets can make an innocent, well-known address appear to be the scanner. Automatic blocking could then deny access to a legitimate administrator, monitor or customer. If you eventually enable it:
- Maintain an allowlist for trusted management networks before turning on enforcement.
- Review the rules PSAD creates and verify that they are limited to the intended chain and address family.
- Define a rollback path through console or out-of-band access, not only through the network path that could be blocked.
- Start with conservative conditions and observe the result before expanding enforcement.
- Keep detection and response reviewable; an alert should remain available even when a block is applied.
Common failure modes and fixes
No alerts during a known test
- No firewall evidence: The test did not traverse a LOG rule, or an earlier ACCEPT rule handled it. Place logging on the intended denied path.
- Wrong file: Kernel messages are being written somewhere other than
/var/log/messages. Locate the active syslog destination and configure PSAD accordingly. - Prefix mismatch:
FW_SEARCH_ALLis set toN, but the exact firewall prefix is absent fromFW_MSG_SEARCH. Add the literal prefix or restore all-message searching. - Daemon not running: Check the distribution service status and its own logs before editing detection thresholds.
- Expectation mismatch: A single packet may not satisfy the selected scan pattern or port-range threshold. Use the documented defaults as a starting point and interpret the resulting evidence.
Too many alerts
- Identify recurring health checks, monitoring probes, internal scanners and port-knocking traffic.
- Use the narrowest applicable ignore setting—port, interface or exact log prefix—rather than disabling all-message analysis globally.
- Review the packet thresholds and scanned-port threshold only after confirming that the traffic is benign.
- Keep enough logging to investigate real scans; reducing noise by discarding all firewall evidence defeats PSAD’s purpose.
Unexpected blocks or lockout risk
- Disable automatic enforcement while investigating if you still have console access.
- Use the documented PSAD commands to list and remove managed blocks.
- Check for spoofing, shared NAT addresses and trusted monitoring sources before reinstating enforcement.
- Restore access through the provider console or recovery environment if the network path is unavailable.
Where PSAD fits in a VPS security stack
PSAD is a focused detector for traffic visible to an iptables-based firewall. Compare it with another host detector using the properties that affect your deployment:
| Decision axis | Question to answer |
|---|---|
| Firewall and logging integration | Does the tool consume the firewall format and log destination used by this VPS? |
| Coverage | Does it classify TCP flag scans and provide TCP, UDP and ICMP signatures relevant to your threat model? |
| Alert channels | Can it deliver the notifications your team actually monitors, such as syslog and email? |
| Historical analysis | Can you replay rotated logs to tune rules without waiting for a new incident? |
| Tuning controls | Can you set danger thresholds, polling intervals, persistence and targeted exclusions? |
| IPv4, IPv6 and nftables behavior | Is support documented for the address families and firewall implementation in the chosen VPS image? Do not assume native nftables support from iptables documentation. |
| Resource use | What daemon, log volume and notification overhead is acceptable for the VPS workload? |
| Response model | Is the product alert-only, or can it modify firewall rules? If it can block, what allowlist and rollback controls exist? |
PSAD’s documented strength is its lightweight, iptables-centered workflow with configurable danger levels, alerts and optional automatic blocking. It should complement, not replace, sound firewall policy, secure service configuration, patching and account controls.
Operational checklist
- Install PSAD from the Debian or Ubuntu package and verify the daemons are running.
- Identify the actual syslog file receiving kernel firewall messages.
- Ensure unsolicited traffic reaches a LOG rule before the final deny action.
- Confirm that the logging prefix and
FW_SEARCH_ALL/FW_MSG_SEARCHsettings agree. - Review alerts for source, packet count, port range, classification or signature and danger level.
- Use a controlled, authorized scan to validate the complete path.
- Replay a copied historical log with
psad -Aand--messages-filewhile tuning. - Document benign monitoring and port-knocking traffic with the narrowest ignore settings.
- Keep
ENABLE_AUTO_IDSdisabled until allowlists, rule review and out-of-band rollback are ready. - Recheck the design whenever the VPS image changes its firewall, syslog or init system.
For deeper treatment of PSAD’s detection and response model, the project README points readers to Linux Firewalls: Attack Detection and Response, published by No Starch Press.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
