3

I have read that Port Knocking can be subject to false negative (type II error) due to the optimization techniques of TCP/IP. A correct port knock given by the client may be read as incorrect by the server.

Is this avoidable by using only UDP and/or ICMP ports, and if so could a port knocking daemon open an unmentioned TCP port? Or are UDP and ICMP susceptible to to similar packet mixing?

1
  • 1
    Unless someone has badly miss-configured something, it seems very unlikely that a valid or invalid knock would open some port that was not configured to be opened. I suppose it would depend on the implementation though.
    – Zoredache
    Aug 30, 2011 at 23:26

2 Answers 2

3

You'll get better results if you cite your sources of information; you may be misinterpreting the data, or there are additional details that will change the nature of any answer you get.

In general, though, any port-knocking, regardless of mechanism, can be disturbed by an intermediate active device. Some are more sensitive than others, but if you've got something in the middle that can change packets, there's the possibility that you'll get stomped on. Design your port-knocking appropriately.

2
  • Sorry, my only source for this info is reddit and wikipedia. Your answer does touch on the concept I am curious about, the traffic being interfered with, that is of course a common security concept. My question is more about the nature of port knocking and tcp/ip not so much as a practical security question. I am curious if a port knocking implementation would be subject to the same possible false negative error (inherent to tcp/ip) even if tcp ports were omitted for the knocking sequence. I am now also curious about your advice, I suppose I'll have to look into various portknocking techniques
    – jtrip
    Aug 31, 2011 at 3:00
  • Even if your sources are reddit and wikipedia, being able to read the data you're basing your opinions for ourselves can help us form better answers.
    – womble
    Aug 31, 2011 at 4:39
1

Port knocking has many limitations that are fixed by Single Packet Authorization (SPA). The limitations in port knocking typically include: replay attacks are usually easy, the PK server can be trivially DoS'd by an intermediate device spoofing a packet to the most recently seen port, not very much data can be transmitted (which makes is difficult to build in robust security protections), and more. These issues are solved by SPA as implemented by "fwknop" (http://www.cipherdyne.org/fwknop/) and described in this paper: http://www.cipherdyne.org/fwknop/docs/SPA.html Disclaimer: I wrote the paper and developed fwknop, so I'm obviously biased.

1
  • Thanks for the info! I read something briefly about spa previously and didn't get it immediately but your paper explained it. I'll have to look into that some more.
    – jtrip
    Aug 31, 2011 at 4:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .