The Port Scan Attack Detector (psad) is a collection of three system daemons that are designed to work with the Linux Netfilter firewalling code to detect port scans and other suspect traffic. It features a set of highly configurable danger thresholds (with sensible defaults), verbose alert messages, email alerting, DShield reporting, and automatic blocking of offending IP addresses.
