Port Knocking: Beyond the Basics

Port knocking has recently become a popular and controversial topic in security. A basic overview of port knocking is given, and it is assumed that when carefully implemented, port knocking can be a useful tool in some situations. Two problems with static port knocking - detection and replay - are described, and three solutions are proposed: covert knocks, dynamic knocks, and one-time knocks. Four current implementations of port knocking are analyzed to demonstrate these solutions. An implementation using Net::Pcap generates static covert knocks over DNS. Cerberus encapsulates knocks in ICMP ping packets and uses one-time passwords for authentication. The SIG^2 Port Knocking Project implements dynamic knocks that are generated randomly and as needed. COeK implements the One-Time Password specification to send onetime knocks over UDP. The improvements of these implementations over static port knocking mitigate some threats, but several concerns still exist. Implementations aimed at the enterprise environment will need to address additional needs. In conclusion, port knocking deserves future consideration and can be a valuable layer in defense-in-depth.