Only in the case of naive port knocking. You can always generate the knocking sequence with something like TOTP to avoid replay attacks, while also detecting at

Only in the case of naive port knocking. You can always generate the knocking sequence with something like TOTP to avoid replay attacks, while also detecting attempts at replaying a previous knock. Edit: Sorry I misread your comment as talking about replay attacks, not MITM'ing. I'm not an expert, but I believe MITM attacks are typically mitigated by performing the knock out of band over a covert channel (DNS, etc). AFAIK, there isn't really a way to prevent them entirely.