Not with single packet authentication from fwknop

http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html#w...

fwknop has a cache to prevent replay attacks, that plus the fact the packets are only valid for a certain length of time pretty much thwarts this. Remember, fwknop is _in addition_ to your existing security practices, it is not the only "password."

"A port knock is just a clear password"

It is only clear to the routers in your traceroute ... third party attackers cannot snoop on this traffic.