I agree with 1. and 3., but not 2.: It's basically like a password where ports are your alphabet. Assuming you use most of the 2^16 ports, and a typical text p

I agree with 1. and 3., but not 2.: It's basically like a password where ports are your alphabet. Assuming you use most of the 2^16 ports, and a typical text password is based on an alphabet of ~70 characters, each knocking step is roughly equivalent to log_70(2^16) ≃ 2.61 traditional password characters. For example, 5 steps of knocking already entail (2^16)^5 ≃ 1.2*10^24 steps to check. With 1000 attempts per second, that still means trying > 10^13 years until all combinations have been tried.