sent to the remote user at any time. While this technique for securing access to remote network daemons has not been widely adopted by the security community, it has been actively used in many rootkits even before year 2000. Benefits Defeating port knocking protection requires large-scale brute force attacks in order to discover even simple sequences. An anonymous brute force attack against a three-knock TCP sequence (e.g. port 1000, 2000, 3000) would require an attacker to test every three port combination in the 1–65535 range and then scan each port between attacks to uncover any changes in port access on the target system. Since port knocking is by definition stateful, the requested port would not open until the correct three-port number sequence had been received in the correct order and without receiving any other intervening packets from the source. The average case scenario requires approximately 141 trillion (655353 / 2) packets to determine a correct three-port number. This technique, in combination with knock attempt-limiting, longer or more complex sequences and cryptographic hashes, makes successful port access attempts extremely difficult. Once the successful port knock sequence is supplied to open a port, firewall rules generally only open the port to the IP address that supplied the correct knock, adding dynamic functionality to firewall behaviour. Instead of using a preconfigured static IP whitelist on the firewall, an authorised user situated anywhere in the world would be able to open any necessary port without assistance from the server administrator. The system could also be configured to allow the authenticated user to manually close the port once the session is over or to have it close automatically using a timeout mechanism. To establish a new session, the remote user would be required to reauthenticate using the correct sequence. The stateful behaviour of port knocking allows several users from different source IP addresses to be at varying levels of port knock authentication simultaneously, allowing a legitimate user with the correct knock sequence through the firewall while the firewall itself is in the middle of a port attack from multiple IP addresses (assuming the bandwidth of the firewall is not completely consumed). From any other attacking IP address, the ports on the firewall will still appear to be closed. Using cryptographic hashes inside the port knock sequence defends against packet sniffing between the source and target machines, preventing discovery of the port knock sequence or using