Quote Originally Posted by Styno
Hmm, have you read the article and/or website?
Of course.

You are right that currently, portknocking is sufficiently unused that no script kiddie is going to bother trying to hack through it.

But other than that, it doesn't in and of itself provide any particular security. The problem is still the same: some potentially malicious packets arrive at your host and trigger some code to be executed, and you have to make sure that this code is safe for all possible malicious sets of packets.

Those packets can be part of a normal TCP connection to the SSH port triggering kernel TCP code and user-level SSH daemon code.

Or they can be part of the ICMP level protocol and again trigger kernel code (and rarely user-level code).

Or they can be part of a portknocking protocol, triggering kernel-level code, as well as user-level code (e.g. some kind of syslogger plus the portknock daemon).

So you're really exchanging the portknocking code for the SSH auth code. It's probably a bit safer because it's much less code, but not because "your computer seems not to exist".