Evil Bit Chain¶
This module contains the EvilChain analysis chain which can be used by PATHspider’s Observer for recording Evil Bit connectivity [RFC3514] details.
-
class
pathspider.chains.evil.
EvilChain
[source]¶ Field Name
Type
Meaning
evilbit_syn_fwd
bool
True if the evil bit was set in the IP header for a TCP SYN packet in the forward direction, false otherwise
evilbit_syn_fwd
bool
True if the evil bit was set in the IP header for a TCP SYN packet in the reverse direction, false otherwise
evilbit_data_fwd
bool
True if the evil bit was set in the IP header for a non-TCP packet in the forward direction, false otherwise
evilbit_data_rev
bool
True if the evil bit was set in the IP header for a non-TCP packet in the reverse direction, false otherwise
-
ip4
(rec, ip, rev)[source]¶ Records evil bit markings from an IPv4 header.
- Evil Bit Marking
For either TCP_SYN packets or non-TCP or TCP with payload packets the relevant field will record whether the Evil Bit was set.
- Parameters
rec (dict) – the flow record
ip (plt.ip) – the IPv4 packet that was observed to be part of this flow
rev (bool) – True if the packet was in the reverse direction, False if in the forward direction
- Returns
Always
True
- Return type
bool
-