With knockd a serv­er can be con­fig­ured to respond only after some ports were checked before. Its often used for SSH. Couter­mea­sure: Sniff traf­fic and wait for an user to login and recon­struct the knock­ing pat­tern out of the pcaps.