# Port Knocking **URL:** \ **Category:** Ruby\ **Created:** [December 21, 2005, 2:49am UTC](https://www.ruby-forum.com/t/port-knocking/74062 "2005-12-21T02:49:56Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [December 21, 2005, 2:49am UTC](https://www.ruby-forum.com/t/port-knocking/74062/1 "2005-12-21T02:49:56Z")
Has anyone seen (or written) any port knocking implementations in Ruby? I couldn’t see any in the RAA or RubyForge (unless it’s under a name I missed). Is there any interest for this sort of thing? I wrote a mini-script to do it with ICMP but I’m not a programmer and it most likely bites. [http://www.spannermonkey.info/rknock.html](http://www.spannermonkey.info/rknock.html) It requires libpcap and ruby-libpcap. Suggestions are welcome. I wanted to be able to knock without a client, hence the ping thing. Sven ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [December 21, 2005, 4:32am UTC](https://www.ruby-forum.com/t/port-knocking/74062/2 "2005-12-21T04:32:06Z")
Pretty neat… I was interested in doing this a while back but never got around to it (and never will at this rate). Are typical port-knocking setups tcp or udp based? I would think that the handshake portion would be UDP… Because ICMP is filtered by many ISPs, how difficult would it be to set this up with udp? ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [December 21, 2005, 5:20am UTC](https://www.ruby-forum.com/t/port-knocking/74062/3 "2005-12-21T05:20:10Z")
Port knocking is normally TCP and UDP although there are a number of implementations with ICMP. It wouldn’t be much harder to do with UDP but that means that a client would be required as I don’t know of any(standard) unix programs that can send custom TCP or UDP packets. I’m looking at fixing a few of the things in the script like the timeout so I might throw in an option for TCP/UDP and a small client. ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [December 21, 2005, 6:47am UTC](https://www.ruby-forum.com/t/port-knocking/74062/4 "2005-12-21T06:47:27Z")
On 12/20/05, removed\_email\_address@domain.invalid [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Port knocking is normally TCP and UDP although there are a number of > implementations with ICMP. It wouldn’t be much harder to do with UDP > but that means that a client would be required as I don’t know of > any(standard) unix programs that can send custom TCP or UDP packets. > I’m looking at fixing a few of the things in the script like the > timeout so I might throw in an option for TCP/UDP and a > small client. Check out Timeout, part of the standard library. [http://www.ruby-doc.org/stdlib/libdoc/timeout/rdoc/](http://www.ruby-doc.org/stdlib/libdoc/timeout/rdoc/) Also, you can portknock on TCP with any web browser. Just in case that helps. 🙂 ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [December 21, 2005, 6:56am UTC](https://www.ruby-forum.com/t/port-knocking/74062/5 "2005-12-21T06:56:27Z")
On 12/20/05, removed\_email\_address@domain.invalid [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Port knocking is normally TCP and UDP although there are a number of > implementations with ICMP. It wouldn’t be much harder to do with UDP > but that means that a client would be required as I don’t know of > any(standard) unix programs that can send custom TCP or UDP packets. > I’m looking at fixing a few of the things in the script like the > timeout so I might throw in an option for TCP/UDP and a > small client. If you are wanting to test, hping ( [http://www.hping.org/](http://www.hping.org/) ) can send arbitrary packets (of pretty much any type). Might look into that for udp/tcp testing. Andy D. ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [December 21, 2005, 2:54pm UTC](https://www.ruby-forum.com/t/port-knocking/74062/6 "2005-12-21T14:54:42Z")
- removed\_email\_address@domain.invalid (removed\_email\_address@domain.invalid) wrote: > Has anyone seen (or written) any port knocking implementations in Ruby? > I couldn’t see any in the RAA or RubyForge (unless it’s under a name I > missed). Is there any interest for this sort of thing? Probably. I’ve been using Ruby more and more frequently in place of Perl for system administration tasks, and every little google hit helps. You might also be interested in the recent Ars Technica article about monitoring packets with libpcap and Ruby: [Monitoring network traffic with Ruby and Pcap | Ars Technica](http://arstechnica.com/articles/columns/linux/linux-20051002.ars) > I wrote a > mini-script to do it with ICMP but I’m not a programmer and it most > likely bites. All I know is your debugging output is great! When it’s finished will it say “Chevron 7 locked” or “Chevron 7 engaged”, or both? 😃 ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [December 30, 2005, 12:24pm UTC](https://www.ruby-forum.com/t/port-knocking/74062/7 "2005-12-30T12:24:23Z")
On 21 Dec 2005, at 5:32am, removed\_email\_address@domain.invalid wrote: > You can try it just with tcpdump -n. When you try to connect to > the local ip address using port 7000, it doesn’t show up in the dump. To dump packets to/from the loopback, you need to tell tcpdump to look at the correct interface [otherwise it defaults to the Ethernet - en0 on Mac OS X]: ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [December 21, 2005, 9:55pm UTC](https://www.ruby-forum.com/t/port-knocking/74062/8 "2005-12-21T21:55:32Z")
Thanks for the tip. I’ve been wanting to implement a proper timeout. The current one is packet dependant. It works, but it’s not nice. I tried telnet and netcat to portknock but if there’s no port open, nothing comes up in the dump. I don’t know why that is but I’m guessing that libpcap only shows the packets if the TCP session is established. Maybe there is an option to change that behaviour but I couldn’t find it. You can try it just with tcpdump -n. When you try to connect to the local ip address using port 7000, it doesn’t show up in the dump. Same deal with ruby-libpcap(same library). require ‘pcap’ dev = Pcap.lookupdev cap = Pcap::Capture.open\_live(dev) cap.loop do |pkt| puts pkt end I am using MacOS 10.4 so it may be some Mac weirdness at the kernel level or how libpcap talks to the kernel but I’ve had no success so far. That’s why I was interested to see if anyone else had done it. Sven