lock for knownClients
private to protected