Port knocking is usually implemented by configuring a daemon to watch the firewall log file for said connection attempts then modify the firewall configuration accordingly.
Most portknocks are stateful systems in that if the first part of the "knock" has been received successfully, an incorrect second part would not allow the remote user to continue and, indeed, would give the remote user no clue as to how far through the sequence they failed.