[justinsaccount]

> I can copy your knock and get access,

You can? how? I just logged into a server using port knocking. what was my knocking sequence? What do you have access to?

> I can deny you service by messing up your knocks by sending packets with a fake IP

Ok, I'm ready when you are.

> insanely inefficient in the amount of data and time spent vs the amount of information exchanged

I don't even know what this means. How is a few extra packets at the start of a tcp connection "insanely inefficient" ?

[tptacek]

Who cares? Serious attackers have access to the actual TCP connection you make to sshd. If there's a preauth vulnerability in sshd, they'll just use that to deliver the payload.

Port knocking is silly. If you're scared of preauth sshd zero-day, deploy an encrypted tunnel.

[Nokinside]

How big percentage of attackers have access to TCP connection and can do MITM attack?

[drudru11]

Serious attackers have physical access

[tptacek]

1. No.

2. What's your point?

[penguinduck]

Now you are being intentionally obtuse. Bye.