The packets captured with this command are packets whit the evil bit set? Should i worry about?

sudo tcpdump 'ip[6] & 128 != 0'

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
0 packets captured
328 packets received by filter
321 packets dropped by kernel

the link where I found this comand https://danielmiessler.com/study/tcpdump/#examples thank you

1 Answer 1


The "evil bit" is a joke described in the famous April Fool's RFC 3514. It is not implemented in reality because it would be foolish to do so. You have nothing to worry about.

From Wikipedia:

The evil bit is a fictional IPv4 packet header field proposed in RFC 3514, a humorous April Fools' Day RFC from 2003 authored by Steve Bellovin. The RFC recommended that the last remaining unused bit, the "Reserved Bit," in the IPv4 packet header be used to indicate whether a packet had been sent with malicious intent, thus making computer security engineering an easy problem – simply ignore any messages with the evil bit set and trust the rest.

  • 1
    Of course, the questioner's question then progresses to become The packets captured with this command have an unused and reserved bit set. which is still worthy of enquiry. Although there is an assumption in there. (-:
    – JdeBP
    May 1, 2018 at 7:36
  • The output is always 0 except this.
    – adc
    May 1, 2018 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.