---
name: "portsentry"
section: "8"
platform: "linux"
package: "portsentry"
version: "1.2-16"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/portsentry"
---

# portsentry(8)

detect portscan activity

## NAME

portsentry - detect portscan activity

## SYNOPSIS

**portsentry** *\[ -tcp \| -stcp \| -atcp \]*\
 **portsentry** *\[ -udp \| -sudp \| -audp \]*

## DESCRIPTION

This manual page documents briefly the **portsentry** command. This manual page was written for the Debian GNU/Linux distribution because the original program does not have a manual page.

**portsentry** is a program that tries to detect portscans on network interfaces with the ability to detect stealth scans. On alarm portsentry can block the scanning machine via hosts.deny (see [**hosts\_access**(5)](/hosts_access/5.md), firewall rule (see [**ipfwadm**(8)](/ipfwadm/8.md)**,** [**ipchains**(8)](/ipchains/8.md) and [**iptables**(8)](/iptables/8.md)) or dropped route (see [**route**(8)](/route/8.md)).

## OPTIONS

For details on the various modes see */usr/share/doc/portsentry/README.install*

- **-tcp**

  tcp portscan detection on ports specified under  *TCP\_PORTS* in the config file  */etc/portsentry/portsentry.conf*.

- **-stcp**

  As above but additionally detect stealth scans.

- **-atcp**

  Advanced tcp or inverse mode. Portsentry binds to all unused ports below  *ADVANCED\_PORTS\_TCP* given in the config file */etc/portsentry/portsentry.conf*.

- **-udp**

  udp portscan detection on ports specified under *UDP\_PORTS* in the config file */etc/portsentry/portsentry.conf*.

- **-sudp**

  As above but additionally detect "stealth" scans.

- **-audp**

  Advanced udp or inverse mode. Portsentry binds to all unused ports below  *ADVANCED\_PORTS\_UDP* given in the config file */etc/portsentry/portsentry.conf*.

## CONFIGURATION FILES

**portsentry** keeps all its configuration files in  **/etc/portsentry.** **portsentry.conf** is **portsentry**'s main configuration file. See  [**portsentry.conf**(5)](/portsentry.conf/5.md) for details.

The file  **portsentry.ignore** contains a list of all hosts that are ignored, if they connect to a tripwired port. It should contain at least the localhost(127.0.0.1), 0.0.0.0 and the IP addresses of all local interfaces. You can ignore whole subnets by using a notation \<IP Address\>/\<Netmask Bits\>. It is  \*not\* recommend putting in every machine IP on your network. It may be important for you to see who is connecting to you, even if it is a "friendly" machine. This can help you detect internal host compromises faster.

If you use the */etc/init.d/portsentry* script to start the daemon, **portsentry.ignore** is rebuild on each start of the daemon using  **portsentry.ignore.static** and all the IP addresses found on the machine via **ifconfig**.

**/etc/default/portsentry** specifies in which protocol modes **portsentry** should be startet from */etc/init.d/portsentry* There are currently two options:

- **TCP\_MODE=**

  either **tcp**, **stcp** or **atcp** (see **OPTIONS** above).

- **UDP\_MODE=**

  either **udp**, **sudp** or **audp** (see **OPTIONS** above).

The options above correspond to portsentry's commandline arguments. For example **TCP\_MODE="atcp"** has the same effect as to start portsentry using **portsentry** **-atcp.** Only one mode per protocol can be started at a time (i.e. one tcp and one udp mode).

## FILES

**/etc/portsentry/portsentry.conf** main configuration file

- **/etc/portsentry/portsentry.ignore**

  IP addresses to ignore

- **/etc/portsentry/portsentry.ignore.static**

  static IP addresses to ignore

- **/etc/default/portsentry**

  startup options

- **/etc/init.d/portsentry**

  script responsible for starting and stopping the daemon

- **/var/lib/portsentry/portsentry.blocked.\***

  blocked hosts(cleared upon reload)

- **/var/lib/portsentry/portsentry.history**

  history file

## SEE ALSO

**[portsentry.conf(5)](/portsentry.conf/5.md),** **[hosts\_access(5)](/hosts_access/5.md),** **[hosts\_options(5)](/hosts_options/5.md),** **[route(8)](/route/8.md),** **[ipfwadm(8)](/ipfwadm/8.md),** **[ipchains(8)](/ipchains/8.md),** **[iptables(8)](/iptables/8.md),** **[ifconfig(8)](/ifconfig/8.md)**

**/usr/share/doc/portsentry/README.install**

## AUTHOR

**portsentry** was written by Craig H. Howland **\<crowland@users.sf.net\>.**

This manual page was stitched together by Guido Guenther \<agx@debian.org\>, for the Debian GNU/Linux system (but may be used by others). Some parts are just a cut and paste from the original documentation.