[srisa]

Each value is a 16-bit number, with a size of two bytes, or equal to two ASCII characters or one Unicode character. Port knocking examples generally do not run to more than three packets, which means that the minimum amount of information a prospective attacker would need to get right in order to gain access is six bytes, equal to six ASCII characters or three Unicode characters.

Is the brute force effort being simplified too much? Wikipedia entry says this about brute force attack on port-knocking: As a stateful system, the port would not open until after the correct three-digit sequence had been received in order, without other packets in between.

That equates to a maximum of 655363 packets in order to obtain and detect a single successful opening, in the worst case scenario. That's 281,474,976,710,656 or over 281 trillion packets. On average, an attempt would take approximately 9.2 quintillion packets to successfully open a single, simple three-port TCP-only knock by brute force.

[thomaslangston]

Could you clarify your maximum packets math? You may have left out a word or two.

[srisa]

Maximum packet maths came from the wikipedia entry. http://en.wikipedia.org/wiki/Port_knocking . First two paragraphs under the "Benefits" section.

[thomaslangston]

I see.

You wrote:

"That equates to a maximum of 655363 packets in order to obtain and detect a single successful opening."

They wrote:

"That equates to a maximum of 65536 ^ 3 packets in order to obtain and detect a single successful opening."