evil-bit

eBPF tooling to implement RFC 3514 - the "evil bit" in the IPv4 header.

• evil-set: Sets the evil bit on all outbound packets
• evil-filter: Drops all inbound packets with the evil bit set

Build with nix-shell --run make, run with sudo.

Usage

Both evil-filter and evil-set require super user permissions or CAP_SYS_ADMIN

Usage: ./evil-filter [-d | -u] [-e] [-i interface] [-x ports]

Drops all inbound IPv4 packets with the RFC 3514 evil bit set.

Modes:
  (default)  Attach, show live stats, detach on Ctrl+C
  -d         Install and exit (program persists in kernel)
  -u         Uninstall a previously installed program

Options:
  -e         Evil-only: drop non-evil packets, allow evil ones
  -i IFACE   Attach to specific interface (default: all non-loopback)
  -x PORTS   Comma-separated ports to exclude (e.g. -x 22,53)
  -h         Show this help

Usage: ./evil-set [-d | -u] [-i interface] [-x ports]

Sets the RFC 3514 evil bit on all outbound IPv4 packets.

Modes:
  (default)  Attach, show live stats, detach on Ctrl+C
  -d         Install and exit (program persists in kernel)
  -u         Uninstall a previously installed program

Options:
  -i IFACE   Attach to specific interface (default: all non-loopback)
  -x PORTS   Comma-separated ports to exclude (e.g. -x 22,53)
  -h         Show this help