undefined | Better HN

0 pointsfullspectrumdev1y ago0 comments

I’ve written a few toy port knocking implementations, and doing it right is hard.

If your connections crap and there’s packet loss, some of the sequence may be lost.

Avoiding replay attacks is another whole problem - you want the sequence to change based on a shared secret and time or something similar (eg: TOTP to agree the sequence).

Then you have to consider things like NAT…

0 comments

dspillett1y ago

Also, if you are trying to connect to a resource from a restrictive network your knocking sequence might be blocked by filters at the client end.

I've been on networks that allow nothing except the standard TCP & UDP ports for HTTP(S), SSH and DNS (and even then DNS was restricted to their local name server).

j / k navigate · click thread line to collapse