UFW

Report port scanners from the Ubuntu firewall log.

UFW, the default firewall on Ubuntu, logs blocked packets. Anything that knocks on twenty or more different closed ports is scanning you.

Turn on logging

sudo ufw logging low

Report port scanners

grep "UFW BLOCK" /var/log/ufw.log | sed -nE 's/.*SRC=([0-9a-fA-F.:]+) .*DPT=([0-9]+).*/\1 \2/p' | sort -u | awk '{print $1}' | uniq -c | awk '$1>=20{print $2}' | xargs -r -I{} curl -s "https://isipsafe.com/api/v1/report?key=$ISIPSAFE_KEY" -d ip={} -d categories=port-scan -d comment="hit 20+ closed ports"

Run it hourly from cron. For plain iptables or nftables with a LOG rule, the same command works on /var/log/kern.log; change the first grep to match your log prefix.

Tune it

• Raise the threshold on busy servers. Twenty distinct ports in a day is a scan; five might be someone's misconfigured monitoring.
• Add categories=port-scan,iot if most hits are on 23, 2323, 7547 and similar device ports.

Need a hand?

If something here does not work with your version of UFW, or you have improved it, tell us. We update these pages with what people send.

UFW and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.