Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
The packets captured with this command are packets whit the evil bit set? Should i worry about?
sudo tcpdump 'ip[6] & 128 != 0' tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes ^C 0 packets captured 328 packets received by filter 321 packets dropped by kernel
the link where I found this comand https://danielmiessler.com/study/tcpdump/#examples thank you
The "evil bit" is a joke described in the famous April Fool's RFC 3514. It is not implemented in reality because it would be foolish to do so. You have nothing to worry about.
From Wikipedia:
The evil bit is a fictional IPv4 packet header field proposed in RFC 3514, a humorous April Fools' Day RFC from 2003 authored by Steve Bellovin. The RFC recommended that the last remaining unused bit, the "Reserved Bit," in the IPv4 packet header be used to indicate whether a packet had been sent with malicious intent, thus making computer security engineering an easy problem – simply ignore any messages with the evil bit set and trust the rest.
