[Fwknop-discuss] UDP listener mode or libpcap?

[Peter S. <aic...@op...>]

I want to deploy fwknop on my server, but I'm not sure If I should use 
the UDP listener mode or libpcap. At first UDP listener mode seems to be 
the choice, because I don't have to compile libpcap. However, I then 
have to open a port in the firewall. Thinking about this, I get the 
feeling that I'm defeating the purpose of using SPA, by allowing 
Internet access to a privileged processe.

If an exploitable security issue is found, even though fwknop remains 
passive and undiscoverable, an attacker could blindly send his exploit 
to random ports on servers he suspects running fwknopd, and after 
maximum 65535 tries he would have root access. I'm not a programmer, so 
I can't review the code of fwknop or SSH daemon, but if both is equally 
likely of having security issues, I might as well just allow direct 
access to the SSH daemon and skip using SPA.

Is my point correct?