A proposal for "silent" port knocking

By itself, a hash of the shared secret and time won't protect against a replay attack within a short time frame (like right after observing the original port knocking sequence). However, if you added in some information about the connection, like the source IP address and port, that would frustrate replay attacks from other systems. Of course, the downside of that is that it would no longer be compatible with NAT.

If the server responds to the knocks with an ICMP error, it might be possible to piggyback some challenge data in the response so that each sequence is unique after the first knock. The client would hash the challenge data with the shared secret to determine the next knock.