Hiding open ports with shimmer

That sounds like a better scheme, yes. Port knocking is less vulnerable to brute-forcing, but
an eavesdropper would be able to just replay the port knocks. Making the port combination a
function of the source IP would secure it somewhat (not entirely -- you still have to
communicate the formula used to derive it!)