Evil Bit Chain

This module contains the EvilChain analysis chain which can be used by PATHspider’s Observer for recording Evil Bit connectivity [RFC3514] details.

class pathspider.chains.evil.EvilChain[source]

Field Name

Type

Meaning

evilbit_syn_fwd

bool

True if the evil bit was set in the IP header for a TCP SYN packet in the forward direction, false otherwise

evilbit_syn_fwd

bool

True if the evil bit was set in the IP header for a TCP SYN packet in the reverse direction, false otherwise

evilbit_data_fwd

bool

True if the evil bit was set in the IP header for a non-TCP packet in the forward direction, false otherwise

evilbit_data_rev

bool

True if the evil bit was set in the IP header for a non-TCP packet in the reverse direction, false otherwise

ip4(rec, ip, rev)[source]

Records evil bit markings from an IPv4 header.

Evil Bit Marking

For either TCP_SYN packets or non-TCP or TCP with payload packets the relevant field will record whether the Evil Bit was set.

Parameters
  • rec (dict) – the flow record

  • ip (plt.ip) – the IPv4 packet that was observed to be part of this flow

  • rev (bool) – True if the packet was in the reverse direction, False if in the forward direction

Returns

Always True

Return type

bool

new_flow(rec, ip)[source]

For a new flow, all fields will be initialised to None.

Parameters
  • rec (dict) – the flow record

  • ip (plt.ip or plt.ip6) – the IP or IPv6 packet that triggered the creation of a new flow record

Returns

Always True

Return type

bool