macOS
Homebrewverified · 100%
brew install knocklocal Homebrew formula metadata
MacPortsverified · 94%
sudo port install knockMacPorts ports tree · net/knock/Portfile · source: api.github.com
brew
Install knock with Homebrew, apk, dnf, MacPorts, zypper, apt, pacman
Port-knock server. Version 0.8 via Homebrew; verified from local package data.
install
Additional install commands
Linux
Alpine Linux apkverified · 92%
sudo apk add knockAlpine Linux edge package indexes · knock · source: dl-cdn.alpinelinux.org
Fedora dnfverified · 92%
sudo dnf install knockFedora Rawhide package metadata · knock · source: dl.fedoraproject.org
openSUSE zypperverified · 92%
sudo zypper install knockopenSUSE Tumbleweed package metadata · knock · source: download.opensuse.org
Debian aptverified · 92%
sudo apt install knockdDebian stable package indexes · knockd · source: deb.debian.org
Arch Linux pacmanverified · 92%
sudo pacman -S knockdArch Linux sync databases · knockd · source: geo.mirror.pkgbuild.com
overview
Package summary
Port-knock server
Project links
Commands and aliases
- knock
- knock_helper_ipt.sh
- knockd
history
Project history and usage
knock is Judd Vinet's port-knocking server and client. It watches network traffic with libpcap for a configured sequence of port hits and runs commands, commonly firewall changes, when the sequence matches.
Project history
The README carries a 2004 copyright notice and describes the core design that still defines the package: closed ports can receive a secret sequence because knockd sniffs link-layer traffic rather than listening on those ports. The bundled ChangeLog lists 0.1 as the initial release and shows later work adding TCP flag handling, reload behavior, timeouts, kernel-space BPF filtering, one-time sequences, interface selection, and IPv6 support.
Version 0.8 was published on 2021-04-24 with multiple fixes and IPv6 support. The GitHub repository retained a small C codebase, an example `knockd.conf`, and manpage documentation rather than growing into a larger access-control framework.
Adoption history
knock spread through Unix-like distributions because it solved a specific sysadmin problem with a small daemon and client. Package names vary between `knock`, `knockd`, and distribution-specific formula names, but the underlying model stayed close to the original README example: a knock sequence opens SSH, and another sequence closes it.
How it is used
A server runs `knockd` with a configuration file such as `/etc/knockd.conf`; a client runs `knock` to send TCP or UDP packets to the configured sequence. Commands usually add or remove firewall rules, so the tool is operationally simple but security-sensitive: the sequence should be treated like a shared secret and firewall commands must be written carefully.
Why package nerds care
knock is a memorable package because it embodies a whole security pattern in a tiny Unix daemon. It is also a reminder of the early-2000s sysadmin style: libpcap, iptables commands, config files, and a tiny client were enough to make a practical layer around SSH exposure.
Timeline
- 2004: README copyright identifies Judd Vinet's original project era.
- 0.1: ChangeLog records the initial release.
- 0.3: ChangeLog added PPP support, command timeout directives, SIGHUP config reloads, and per-port protocols.
- 0.5: ChangeLog added one-time sequences, interface selection, BPF filtering, and security fixes.
- 0.7: ChangeLog documented the target directive and consolidated OS-specific networking code.
- 2021-04-24: v0.8 release published with fixes and IPv6 support.
Related projects
- knock is related to other port-knocking and single-packet-authorization tools, firewall managers such as iptables, packet crafting tools such as sendip, and SSH hardening workflows.
Sources
security posture
Risk level: blue
broad file, network, media, or database tool signal.
Risk classifier
blue risk · medium confidence · tool
Why
- broad file, network, media, or database tool signal
Signals
- text:server
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 13 platform targets.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Configuration files
Config paths the tool may read or write during local use.
- Unix
/etc/knockd.conf
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
knock | cli | global executable | |
knock_helper_ipt.sh | cli | global executable | |
knockd | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version0.8
manager updated
local dataok
upstreamnot checked
latest detectednot detected
https://github.com/jvinet/knock
- infoNo package-manager update timestamp was available.low confidence
- infoNo cached GitHub release or tag data was available.https://github.com/jvinet/knocknone confidence
install metadata
Package metadata
| Package key | brew:knock |
|---|---|
| Version | 0.8 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/knock |
| Homepage | https://github.com/jvinet/knock |
| Repository | https://github.com/jvinet/knock |
| Upstream docs | https://github.com/jvinet/knock#readme |
| License | GPL-2.0-or-later |
| Source archive | https://github.com/jvinet/knock/releases/download/v0.8/knock-0.8.tar.gz |
| Uses from macOS | libpcap |
| Bottle | available (on arm64_big_sur, arm64_linux, arm64_monterey, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, big_sur, catalina, monterey, sonoma, ventura, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | knock |
| Version Scheme | 0 |
| Revision | 0 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
apk95%
knock 0.8.2-r2
A simple port-knocking daemon
https://github.com/TDFKAOlli/knock
sudo apk add knock- License: GPL-2.0-or-later
- Architecture: x86_64
- Source Package: knock
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Knock
apk95%
knock-doc 0.8.2-r2
A simple port-knocking daemon (documentation)
https://github.com/TDFKAOlli/knock
sudo apk add knock-doc- License: GPL-2.0-or-later
- Architecture: x86_64
- Source Package: knock
- normalized package name match
- Matched by: Knock
apk95%
knock-openrc 0.8.2-r2
A simple port-knocking daemon (OpenRC init scripts)
https://github.com/TDFKAOlli/knock
sudo apk add knock-openrc- License: GPL-2.0-or-later
- Architecture: x86_64
- Source Package: knock
- normalized package name match
- Matched by: Knock
dnf95%
knock 0.8-13.fc44
A port-knocking server/client
http://www.zeroflux.org/projects/knock
sudo dnf install knock- License: GPL-2.0-or-later
- Category: Unspecified
- Architecture: x86_64
- Source Package: knock
- 3 dependencies
- 1 provides
- normalized package name match
- Matched by: Knock
dnf95%
knock-server 0.8-13.fc44
A port-knocking server/client
http://www.zeroflux.org/projects/knock
sudo dnf install knock-server- License: GPL-2.0-or-later
- Category: Unspecified
- Architecture: x86_64
- Source Package: knock
- 6 dependencies
- 2 provides
- normalized package name match
- Matched by: Knock
zypper95%
knock 0.8-4.4
A Port-Knocking Client
http://www.zeroflux.org/knock/
sudo zypper install knock- License: GPL-2.0-or-later
- Category: Productivity/Networking/Security
- Architecture: x86_64
- Source Package: knock
- 2 dependencies
- 1 provides
- normalized package name match
- Matched by: Knock
zypper95%
knockd 0.8-4.4
A port-knocking server
http://www.zeroflux.org/knock/
sudo zypper install knockd- License: GPL-2.0-or-later
- Category: Productivity/Networking/Security
- Architecture: x86_64
- Source Package: knock
- 4 dependencies
- 2 provides
- normalized package name match
- Matched by: Knock
MacPorts95%
knock
sudo port install knock- normalized package name match
- Matched by: Knock
Debian apt92%
knockd 0.8-2+b6
small port-knock daemon
http://www.zeroflux.org/projects/knock
sudo apt install knockd- Section: net
- Architecture: amd64
- Source Package: knockd
- 4 dependencies
- installed executable or alias match
- Matched by: Knockd
Ubuntu apt92%
knockd 0.8-2build2
small port-knock daemon
http://www.zeroflux.org/projects/knock
sudo apt install knockd- Section: universe/net
- Architecture: amd64
- 4 dependencies
- installed executable or alias match
- Matched by: Knockd
pacman92%
knockd 0.8-2
A simple port-knocking daemon
https://github.com/jvinet/knock
sudo pacman -S knockd- License: GPL-2.0-or-later
- Architecture: x86_64
- 1 dependencies
- installed executable or alias match
- Matched by: Knockd
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated configuration and credential file locations
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment