3-4 Ports

In computing, port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. more...

Home
Cables, Connectors
Filers, Load Balancers
Home Networking, Cable & DSL
Hubs
KVM Switch Boxes, Cables
KVM Cables Only
KVM Switch Boxes
2 Port & Under
3-4 Ports
Belkin
Compaq
IOGear
Linksys
Other 3-4 Port KVM
5 Ports & Higher
Apex
Belkin
Compaq
Cybex
Other 5 Port & Higher KVM
Other KVM
Mainframe, DEC, VAX, AS/400
Network Interface Cards,...
Networking, Telecom Tools
Other Networking Equipment
Print Servers, Wired
Racks, Mounts & Patch Panels
Router Components, Memory
Routers, Wired
Security, Firewall, VPN
Server Components, Memory
Servers
Software
Software, Operating Systems
Storage Equipment, NAS, SAN
Switch Components, Memory
Switches
Telephone Systems, Telecom
UPS, Power Protection, APC
Wholesale Lots
Wireless Networking, WiFi
Workstation Components,...
Workstations, Terminals

Once a correct sequence of connection attempts is received the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect over specified port(s).

This is usually implemented by configuring a daemon to watch the firewall log file for said connection attempts then modify the firewall configuration accordingly. It can also be performed by a process examining packets at a higher level (using packet capture interfaces such as Pcap), allowing the use of already "open" TCP ports to be used within the knock sequence.

Port knocking is most often used to determine access to port 22, the Secure Shell (SSH) port. The port "knock" itself is similar to a secret handshake and can consist of any number of TCP, UDP or even sometimes ICMP and other protocol packets to numbered ports on the destination machine. The complexity of the knock can be anything from a simple ordered list (e.g. TCP port 1000, TCP port 2000, UDP port 3000) to a complex time-dependent, source-IP-based and other-factor-based encrypted hash.

A port knock setup takes next to no resources and very simple software to implement. A portknock daemon on the firewall machine listens for packets on certain ports (either via the firewall log or by packet capture). The client user would carry an extra utility, which could be as simple as netcat or a modified ping program or as complicated as a full hash-generator, and use that before they attempted to connect to the machine in the usual way.

Most portknocks are stateful systems in that if the first part of the "knock" has been received successfully, an incorrect second part would not allow the remote user to continue and, indeed, would give the remote user no clue as to how far through the sequence they failed. Usually the only indication of failure is that, at the end of the knock sequence, the port expected to be open is not opened. No packets are sent to the remote user at any time.

While this technique for securing access to remote network daemons has not yet been widely adopted by the security community, it has been integrated in newer rootkits.

How Port knocking works in theory

Step 1

(A) Client cannot connect to application listening on port n; (B) Client cannot establish connection to any port.

Step 2

(1,2,3,4) Client tries to connect to a well-defined set of ports in sequence by sending certain packets; Client has prior knowledge of the port knocking daemon and its configuration, but receives no acknowledgement during this phase because firewall rules preclude any response.

Step 3

Read more at Wikipedia.org