What Is Port Knocking?
On this page
Port knocking hides a service until a client sends a secret sequence of connection attempts — the “knock” — that tells the firewall to open the real port for them. To a scanner, the service simply does not exist. It is a neat trick for shrinking exposure, and a textbook case of obscurity that helps only when it sits on top of real security.
How does it work?#
A daemon watches for a specific sequence of connection attempts to closed ports:
- The service (say SSH) is firewalled off — invisible to scans.
- The client “knocks” by attempting connections to a secret sequence of ports in order.
- The daemon recognizes the sequence and temporarily opens the real port to that source IP.
- The client connects normally; the port closes again afterward.
The effect is that the service is unreachable — and unscannable — to anyone who does not know the sequence.
What is it good for, and not?#
| Provides | Does not provide |
|---|---|
| Reduced attack surface exposure | Authentication of the connection |
| Much less automated-scan noise | Protection if the knock is observed |
| A thin extra layer | A replacement for strong auth |
The honest framing: port knocking is security through obscurity. The knock sequence can be sniffed by anyone watching the network, and it does nothing to authenticate the connection that follows.
Port knocking is obscurity applied to network services. More at the Network Security hub.
Frequently asked questions#
What is port knocking?
Port knocking hides a network service behind a firewall until a client sends a predefined secret sequence of connection attempts to specific closed ports. A daemon watching the firewall logs recognizes the correct "knock" and temporarily opens the real port for that client. Until then, the service appears entirely closed to scanners.
Is port knocking real security?
It is a layer of obscurity, not a replacement for authentication. Port knocking reduces exposure and cuts automated-scan noise, but the knock sequence can be observed by anyone watching the network, and it does not authenticate the eventual connection. Use it on top of strong controls like key-based SSH, never instead of them.