Canaries can run a Custom TCP service on all unused ports. Almost all networks can expect that hosts and devices on them will probe other hosts on the network making many connections to common ports. However, on networks where any unexpected TCP connection raises an alarm, running a Custom TCP service on all unused ports, will let you get alerted if even just one stray connection hits the Canary.
To configure, simply enable a Custom TCP Service and on the first service, then select the "Run this service on all unused ports".
This is feature is not supported on Docker Canaries (as container platforms have other ways to do this).