One of the strongest defenses from cyber-threats today is the use of intrusion detection systems. Port scanning is usually the first action that precedes an intrusion. In turn, the use of virtual network functions (VNF) for cloud computing has become a powerful tool for tenants to provide network functions in high-speed networks. In this paper, we propose a virtual network function to detect distributed port scanning based on a cooperative architecture and on the programmable open source intrusion detection system Bro. The contribution of this paper are fourfold: i) the detection of ACK and NULL scan techniques; ii) the detection of the scan techniques TCP Connect, SYN, FIN, XMAS, ACK and NULL performed in a slow and distributed manner; iii) an architecture for cooperation between VNFs that shares historical logs of scans to improve scan detection in the cloud; iv) an implementation of a prototype of the proposed VNF in the Open Platform for Network Function Virtualization (OPNFV). Our prototype uses the Network Function Virtualization architecture from ETSI and respects the Service Function Chaining standards from IETF. We evaluate our prototype and the results show that we are able to detect all port scanning techniques with a high precision rate.