Portsentry is a program designed to detect and repond to port scans against a target host in real time. It can do this in two ways - by listening on a set of selected ports (basic mode), or by monitoring all ports below a choice number. When a connection on one of the monitored ports is detected, Portsentry records the event in the logs and optionally takes action to block all further traffic from the connecting host.

The options on this page are :

- TCP ports to monitor
  When in basic mode, Portsentry will listen on all the TCP ports listed in the first line for this option. In advanced mode, it will listen on all ports below the number entered on the second line, excluding those listed in the 'except' field.

- UDP ports to monitor
  Like the TCP ports option, but controls which UDP ports are monitored.

- Block TCP probes
  This option controls what action Portsentry takes when it detects a TCP connection to one of the monitored ports. The choices are Yes (block future connections from the host), No (do nothing), or Run kill command (run a command specified in the config file). In all cases, the connection will be recorded in the system logs.

- Block UDP probes
  Like the Block TCP probes option, but controls what happens when a UDP connection is detected.

- Message for blocked connections
  When Portsentry is listening on a port, any connection received will have this message send back before the connection is closed.

- Number of connections before triggering blocking
  The number of 'grace' connections that a host is allowed to make to a monitored port before the host is blocked. If this is set to zero, the first connection will trigger blocking.

- Hosts to ignore traffic from
  The IP addresses, hostnames or IP address/netmasks of hosts and networks from which traffic is ignored.

At the bottom of the page is a button for either starting Portsentry (if it is not running), or stopping it (if it is running). Because Portsentry runs as a pair of background processes (or daemon), if it is not running no monitoring of port scans will be done.