3 ms·
RFC 3514 seems appropriate here: 1. Introduction Firewalls [CBR03], packet filters, intrusion detection systems, and the like often have dif
by willglynn 10y ago
RFC 3514 seems appropriate here:
1. Introduction
Firewalls [CBR03], packet filters, intrusion detection systems, and
the like often have difficulty distinguishing between packets that
have malicious intent and those that are merely unusual. The problem
is that making such determinations is hard. To solve this problem,
we define a security flag, known as the "evil" bit, in the IPv4
[RFC791] header. Benign packets have this bit set to 0; those that
are used for an attack will have the bit set to 1.
https://www.ietf.org/rfc/rfc3514.txt https://www.ietf.org/rfc/rfc3514.txt
- kccqzy 10y agoThis RFC was published on April 1.
- willglynn 10y agoQuite correct, but nonetheless, that RFC does explore the topic of "why not just mark the traffic?" One basic objection which detaro pointed out is that there's nothing to stop attackers from clearing such marks. As Wikipedia puts it: > The evil bit has become a synonym for all attempts to seek simple technical solutions for difficult human social problems which require the willing participation of malicious actors https://en.wikipedia.org/wiki/Evil_bit https://en.wikipedia.org/wiki/Evil_bit