Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have read that Port Knocking can be subject to false negative (type II error) due to the optimization techniques of TCP/IP. A correct port knock given by the client may be read as incorrect by the server.

Is this avoidable by using only UDP and/or ICMP ports, and if so could a port knocking daemon open an unmentioned TCP port? Or are UDP and ICMP susceptible to to similar packet mixing?

share|improve this question
Unless someone has badly miss-configured something, it seems very unlikely that a valid or invalid knock would open some port that was not configured to be opened. I suppose it would depend on the implementation though. – Zoredache Aug 30 '11 at 23:26

You'll get better results if you cite your sources of information; you may be misinterpreting the data, or there are additional details that will change the nature of any answer you get.

In general, though, any port-knocking, regardless of mechanism, can be disturbed by an intermediate active device. Some are more sensitive than others, but if you've got something in the middle that can change packets, there's the possibility that you'll get stomped on. Design your port-knocking appropriately.

share|improve this answer
Sorry, my only source for this info is reddit and wikipedia. Your answer does touch on the concept I am curious about, the traffic being interfered with, that is of course a common security concept. My question is more about the nature of port knocking and tcp/ip not so much as a practical security question. I am curious if a port knocking implementation would be subject to the same possible false negative error (inherent to tcp/ip) even if tcp ports were omitted for the knocking sequence. I am now also curious about your advice, I suppose I'll have to look into various portknocking techniques – jtrip Aug 31 '11 at 3:00
Even if your sources are reddit and wikipedia, being able to read the data you're basing your opinions for ourselves can help us form better answers. – womble Aug 31 '11 at 4:39

Port knocking has many limitations that are fixed by Single Packet Authorization (SPA). The limitations in port knocking typically include: replay attacks are usually easy, the PK server can be trivially DoS'd by an intermediate device spoofing a packet to the most recently seen port, not very much data can be transmitted (which makes is difficult to build in robust security protections), and more. These issues are solved by SPA as implemented by "fwknop" ( and described in this paper: Disclaimer: I wrote the paper and developed fwknop, so I'm obviously biased.

share|improve this answer
Thanks for the info! I read something briefly about spa previously and didn't get it immediately but your paper explained it. I'll have to look into that some more. – jtrip Aug 31 '11 at 4:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.