I would go with something like:

  seed=`date +%s%N`; ( echo "secretknock-20260811|$seed"|sha512sum  ; echo $seed ) | xargs nc -u 192.168.1.1

It is not secure as hmac and it can be 'trivially' brute forced, but don't require extra tools (probably nc not always readily available).

On other hand if threat vector includes network monitor with ability to replay i would use wireguard to wrap ssh traffic.