which would in effect open the port it knocks at
No... It won't.... Please make sure you understand this. It will allow packets sent to that port to reach the port - which is closed. That is significantly different from "opening" the port which means that a service is listening and will respond to a SYN packet with a SYN/ACK. As it is the SYN will reach the port which will respond with an RST packet as it is supposed to.... This will however allow the WinPcap driver to see the packet and log it. However, since this is a simple SYN packet there will most probably be nothing much to be learned from it unless it carries data, which it isn't _supposed_ to. There are however some sneaky forms of malware that only require the data encapsulated in a SYN packet to activate and target them..... In this case I doubt it is anything more than a basic SYN packet trying to contact a "service" it thinks is still at your address.