Port Knocking and Single Packet Authorization: Obscurity With Limits

Port knocking keeps a service's port closed until a client connects to a predefined sequence of other ports. The firewall watches for that sequence from a source address and, when it sees it, opens the real port to that address for a short window. To a scanner, the service simply does not exist.

How it works

A daemon watches firewall logs or the packet stream for connection attempts. A client sends connection attempts to, say, three specific ports in a specific order — the attempts are refused, which is fine, because the point is only that they were observed.

On recognizing the sequence from a source address, the daemon adds a temporary firewall rule permitting that address to reach the protected port. The client then connects normally and authenticates as usual. The rule expires after a timeout or when the session ends.

The knock sequence is not authentication for the service. It is a precondition for the port being reachable at all, and the service's own authentication still applies underneath.

What it genuinely achieves

A hidden port removes the service from scan results, and that has real effects. Automated attack tooling works from lists of responsive hosts, so a service that never answers is never added to those lists and never targeted by the background noise that fills authentication logs on any exposed service — the traffic described under exposed remote access.

It also buys time against a zero-day in the service itself. A vulnerability in an SSH daemon that nobody can reach cannot be exploited remotely, which is a genuine benefit during the window between disclosure and patching.

The weaknesses

Classic port knocking has three real problems, and they are why it is a supplement rather than a control.

It is replayable. An attacker who observes the sequence — on a shared network, at an intermediate hop, or from a compromised client — can simply repeat it. The sequence is a static secret transmitted in the clear.

It can be brute forced. A three-port sequence drawn from 65535 ports is a large space, but not an intractable one for an attacker willing to spend time, and detection of the attempt depends on someone watching.

NAT breaks the model. Because authorization is granted to a source address, every client behind the same public address is authorized once any of them knocks — which in a corporate or mobile network may be thousands of people.

It is also fragile operationally. A client that cannot knock — restrictive outbound filtering, a failing daemon — cannot reach the service, and the failure mode is a support call at the worst moment.

Single packet authorization

SPA is the modern form and fixes most of this. Instead of a port sequence, the client sends one encrypted, authenticated packet containing a timestamp or counter, the requesting source address, and the service being requested.

Because it is cryptographically signed, it cannot be forged. Because it includes a nonce or timestamp, it cannot be replayed. Because it names the requested access, one packet grants exactly what is needed. And because it is a single packet with no response, the service remains invisible to scanning.

Where port hiding is genuinely wanted, SPA is the version to deploy. Port knocking's sequence-of-ports approach persists mainly because it is simple to set up with tools already present.

Where it belongs

Be clear that this is security through obscurity — useful, and not a substitute for anything.

The stronger control for the same problem is not exposing management services to the internet at all: a VPN, a bastion host, or a zero trust access broker authenticates the user before any connection to the protected service is possible, provides identity-based audit rather than address-based, works correctly behind NAT, and does not fail open to anyone who can observe a sequence.

Port knocking or SPA is a reasonable addition where a service must remain internet-facing — a personal server, a device that cannot sit behind a gateway, an emergency access path. Underneath it, the real controls still apply: key-based authentication, multi-factor where passwords remain, current patching, and logging that reaches your SIEM. A knock daemon logging failed sequences is itself a useful signal, since nothing legitimate produces a partial sequence.

Exam angles

Define port knocking as opening a firewall port only after a predefined connection sequence, and classify it as security through obscurity rather than authentication. Know its weaknesses — replay, brute force, and shared source addresses behind NAT — and identify single packet authorization as the encrypted, replay-resistant improvement. Recognize that a VPN or bastion host is the stronger answer when a scenario asks how to protect management access.