A while ago I wrote an article about implementing Port Knocking using iptables. Later in the post, I also talked about making this mechanism more secure.
The way it works is that in order to open a port, like SSH port to connect, you need to knock some other close ports. If you knock those ports in correct sequence, your final port (in this case SSH port 22) will become open to connection.
Recently I realized that any person, even with passive surveillance over the network, can detect the series of ports to knock. A simple MITM attack like ARP Spoofing (within the sub-network) reveals the ports to be knocked easily.

I was curious to know if there exists anyway, other than randomizing the ports each time, to conceal the port numbers from the attacker?

  • 1
    Other than randomizing the ports? No. An attacker who can passively monitor the connection will always see what port a given packet is going to. If the same pattern works two times in a row, you're screwed.
    – forest
    Sep 22, 2018 at 2:50
  • I'm currently implementing a port knocker setup combined with a SOCKS proxy, and considered the same exploitability. I solved it choosing known ports, so 80, 443, 465, 25 etc. Then you blend in with regular traffic. Hiding from DNS, although maybe not practical, can be done by using an IP address. Truly hiding on a network level is harder, but how many flex works spaces and or free wifi hotspots monitor that? ... Hope it helps.
    – GerardJP
    Aug 6, 2019 at 7:22

2 Answers 2


Obviously this is a bit of a frame-challenge, so I understand if you don't like this answer. However:

The biggest advantage (in my mind) of port knocking is that it automatically filters out all the bots on the internet that go around randomly trying to brute-force every SSH server they find. It can also be helpful in that it provides a small additional layer of protection against 0-day vulnerabilities in the SSH server (if no one knows your server is there then they can't attempt a 0-day, even if you are vulnerable). However the point in both of these cases is the same:

Port knocking is most effective as a way of filtering out drive-by attacks against your server

Once you talk about a directed attack (i.e. someone with a MITM observing the port knocking process), then port knocking will definitely fail as a security method. Even if there was a way to hide the port combinations from a dedicated attacker, the fact that they are specifically targeting your organization means that your port knocking security has accomplished its particular job. It is simply supposed to keep out drive-by attackers, and it does as much. Attempting to extend it to cover more targeted attacks which this security method wasn't originally designed for is probably going to cause you more trouble than it is worth (in the implementation and support of new security feature, and the risk of accidentally locking yourself out).

Can you hide the port knocking sequence from a MITM attacker? I'm pretty sure the answer is no, although I'm not ready to make a definitive statement there. Either way though, I think you're going to make a big headache for yourself to attempt to mitigate an attack vector with a defense mechanism that wasn't really designed for it. As a result, I think you're better off finding other ways of securing your servers and keeping your port knocking simple. You're probably already doing this, but simply turning off password-based authentication and allowing authentication via private-keys only is usually the first and most effective security measure for an SSH server and (IMO) a more effective way of blocking out drive-by attacks than port knocking.

  • 3
    I can't give this answer enough props. It's always important to use the right tools: Trying to filter bots brute-forcing from your logs? Port-knocking. Trying to prevent password brute-forcing? PKI auth. Use both, plus a nice fail2ban setup for the non-bots who bypass the port knocker, and you're better secured than 99.99999% of systems out there. Honestly, even just non-standard port + PKI auth is good enough, but f2b is a good way to keep the logs even cleaner. Sep 21, 2018 at 19:42

Port knocking is essentially a non-standard protocol. So too is running non-standard ports, you can do this or invent a miriad of other non-standard protocols but you need to consider your purpose.

If the the primary point is to handle attacks, then something like Fail2Ban setup along the lines of:

If 3 password failures in less than 2 minutes, block Source IP for 30 minutes.

This will drop automated bot attacks from thousands per day to few to none in short order. Actual fat fingering by people can wait out the block.

Add in standard TLS encrypted connections (with certificate verification) and you can handle the MiTM threat. You can even add in client CERTS if you feel the need.

Custom protocols are almost always a bad idea, or difficult to use at best.

If a deeper level of "Hiding" is desired, then consider a Tor Hidden Service.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .