I was just referring to this article: http://en.wikipedia.org/wiki/Port_knocking

The term Port Knocking, as explained here, was slightly confusing and I was feeling difficulty in getting the hang of it. I would be really thankful if anyone could offer a simpler explanation.

  • Can you explain what part you are having trouble understanding? What is your experience level, i.e: are you familiar with IP addresses and ports? I tried to answer with a clearer explaination, but I think Wikipedia did a pretty good job. – David Houde May 8 '14 at 13:09
  • @DavidHoude,I am an undergraduate Computer Science Student so familiar with core networking terms but the idea of externally opening ports on firewall was confusing me. – user1369975 May 8 '14 at 13:19

Let's say you want to be able to SSH into your server from anywhere. But you find that if you leave SSH listening on port 22, systems all over the Internet are regularly trying to log into it and filling up your logs with auth failures. You are offended by this.

So you set up port knocking.

Your firewall blocks access to port 22 - but if packets come for ports 1234 and 5678 in the space of one minute, your firewall will open access to port 22 for a brief window. Therefore, your SSH server is safe from random people (who won't know how to "knock" to open the port) but you can get in whenever you want by sending a couple of special packets before connecting.

In this scenario, ports 1234 and 5678 aren't listening, there's no service running there - the special bit is that the firewall notices attempts to reach those ports and does something accordingly.

As security goes, this is minor; it's a form of security through obscurity, and only offers incremental benefits. It can be useful in cutting down noise from automated attackers, though.

  • Both automated attackers and automated defenders. Port knocking is useful to hide services from your local network admins when they sweep for commonly used ports, unfortunately. – schroeder May 8 '14 at 15:01
  • How about having a stateless TCP echo server on some port which, in addition to echoing incoming bytes, watches for a certain magic sequence and, if that is detected, does something else? I've written a stateless TCP server which simply swaps source and destination IP and sequence numbers, and slightly tweaks the SYN packet before echoing, but stores no information about incoming packets otherwise. Such a thing could be subjected to bandwidth attacks, but not subject to resource-hogging attacks since incoming SYN packets don't hog any resources. Would that seem like a good idea? – supercat Feb 19 '15 at 17:54

Think of port knocking as a combination lock. In order to open a combination lock you have to input the correct sequence of numbers. Port knocking works the same way: a system will attempt to connect to a sequence of TCP or UDP ports, if the correct sequence is sent the firewall will allow some sort of connectivity for that system.

Port knocking has the same vulnerabilities as a combination lock as well. Both can be observed, and the combination seen. Also, both are vulnerable to brute force attacks.

Port knocking is an interesting idea, I've never seen an actual implementation of it though. It's much simpler to allow connectivity based on some sort of authentication like a username/password or two-factor authentication.

  • "open some sort of connectivity for that system" or simply, "open a pre-defined port on that system"? – schroeder May 8 '14 at 14:58
  • It doesn't have to be a single pre-defined port, it could be several ports along with NAT rules. – GdD May 8 '14 at 15:21
  • I get that, but your comment that I quoted is a little confusing. It opens port(s), it does not establish connectivity. – schroeder May 8 '14 at 15:45
  • I see your point, I've edited accordingly – GdD May 8 '14 at 16:05

This is such a broad question. What is it you are trying to accomplish. For example, most individuals I have come across try to use port knocking to minimize (rid themselves) of SSH brute force attacks. For these types of attacks, I recommend using Duo since its dual factor versus security through obscurity (port knocking).

The overall gist of port knocking is based on the premise of a "secret." "No one will ever know I have the keys to my house, hidden under a rock, 10 feet to the left of my door, in the yard, under the green garbage can, not the blue one" The secret is not really a secret because it is there for everyone to find, if someone wants to look hard enough. So what are you trying to accomplish/protect?

  • (I think the OP just wanted an example, not to implement it ...) – schroeder May 8 '14 at 15:02

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.