[tugu77]

Combine the two.

By default, return nonsense on all ports. But once a certain access sequence has been detected from a source IP, redirect traffic to a specific port from just that IP to your real service.

[billyhoffman]

So port knocking, but with also returning junk during the knocking process?