1. Portscan detector for Linux. Scandetd is a portscan detector. By default, it logs incoming TCP connections to the host. If a second connection happens within 1 second, it too is logged to syslog. If scandetd recognizes this pattern as a portscan and sends mail to (by default) root@localhost. Scandetd will also attempt to recognize OS fingerprinting probes. It will attempt to determine the tool being used, at this point Queso or NMAP. From Debian 3.0r0 APT