I was just referring to this article: http://en.wikipedia.org/wiki/Port_knocking

The term Port Knocking, as explained here, was slightly confusing and I was feeling difficulty in getting the hang of it. I would be really thankful if anyone could offer a simpler explanation.

  • Can you explain what part you are having trouble understanding? What is your experience level, i.e: are you familiar with IP addresses and ports? I tried to answer with a clearer explaination, but I think Wikipedia did a pretty good job. May 8, 2014 at 13:09
  • @DavidHoude,I am an undergraduate Computer Science Student so familiar with core networking terms but the idea of externally opening ports on firewall was confusing me. May 8, 2014 at 13:19

3 Answers 3


Let's say you want to be able to SSH into your server from anywhere. But you find that if you leave SSH listening on port 22, systems all over the Internet are regularly trying to log into it and filling up your logs with auth failures. You are offended by this.

So you set up port knocking.

Your firewall blocks access to port 22 - but if packets come for ports 1234 and 5678 in the space of one minute, your firewall will open access to port 22 for a brief window. Therefore, your SSH server is safe from random people (who won't know how to "knock" to open the port) but you can get in whenever you want by sending a couple of special packets before connecting.

In this scenario, ports 1234 and 5678 aren't listening, there's no service running there - the special bit is that the firewall notices attempts to reach those ports and does something accordingly.

As security goes, this is minor; it's a form of security through obscurity, and only offers incremental benefits. It can be useful in cutting down noise from automated attackers, though.

  • Both automated attackers and automated defenders. Port knocking is useful to hide services from your local network admins when they sweep for commonly used ports, unfortunately.
    – schroeder
    May 8, 2014 at 15:01
  • How about having a stateless TCP echo server on some port which, in addition to echoing incoming bytes, watches for a certain magic sequence and, if that is detected, does something else? I've written a stateless TCP server which simply swaps source and destination IP and sequence numbers, and slightly tweaks the SYN packet before echoing, but stores no information about incoming packets otherwise. Such a thing could be subjected to bandwidth attacks, but not subject to resource-hogging attacks since incoming SYN packets don't hog any resources. Would that seem like a good idea?
    – supercat
    Feb 19, 2015 at 17:54

Think of port knocking as a combination lock. In order to open a combination lock you have to input the correct sequence of numbers. Port knocking works the same way: a system will attempt to connect to a sequence of TCP or UDP ports, if the correct sequence is sent the firewall will allow some sort of connectivity for that system.

Port knocking has the same vulnerabilities as a combination lock as well. Both can be observed, and the combination seen. Also, both are vulnerable to brute force attacks.

Port knocking is an interesting idea, I've never seen an actual implementation of it though. It's much simpler to allow connectivity based on some sort of authentication like a username/password or two-factor authentication.

  • "open some sort of connectivity for that system" or simply, "open a pre-defined port on that system"?
    – schroeder
    May 8, 2014 at 14:58
  • It doesn't have to be a single pre-defined port, it could be several ports along with NAT rules.
    – GdD
    May 8, 2014 at 15:21
  • I get that, but your comment that I quoted is a little confusing. It opens port(s), it does not establish connectivity.
    – schroeder
    May 8, 2014 at 15:45
  • I see your point, I've edited accordingly
    – GdD
    May 8, 2014 at 16:05

This is such a broad question. What is it you are trying to accomplish. For example, most individuals I have come across try to use port knocking to minimize (rid themselves) of SSH brute force attacks. For these types of attacks, I recommend using Duo since its dual factor versus security through obscurity (port knocking).

The overall gist of port knocking is based on the premise of a "secret." "No one will ever know I have the keys to my house, hidden under a rock, 10 feet to the left of my door, in the yard, under the green garbage can, not the blue one" The secret is not really a secret because it is there for everyone to find, if someone wants to look hard enough. So what are you trying to accomplish/protect?

  • (I think the OP just wanted an example, not to implement it ...)
    – schroeder
    May 8, 2014 at 15:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .