I have read that Port Knocking can be subject to false negative (type II error) due to the optimization techniques of TCP/IP. A correct port knock given by the client may be read as incorrect by the server.
Is this avoidable by using only UDP and/or ICMP ports, and if so could a port knocking daemon open an unmentioned TCP port? Or are UDP and ICMP susceptible to to similar packet mixing?