RFC 3514 (rfc3514) - Page 2 of 6

The Security Flag in the IPv4 Header

RFC 3514          The Security Flag in the IPv4 Header      1 April 2003


   The bit field is laid out as follows:

             0
            +-+
            |E|
            +-+

   Currently-assigned values are defined as follows:

   0x0  If the bit is set to 0, the packet has no evil intent.  Hosts,
        network elements, etc., SHOULD assume that the packet is
        harmless, and SHOULD NOT take any defensive measures.  (We note
        that this part of the spec is already implemented by many common
        desktop operating systems.)

   0x1  If the bit is set to 1, the packet has evil intent.  Secure
        systems SHOULD try to defend themselves against such packets.
        Insecure systems MAY chose to crash, be penetrated, etc.

3. Setting the Evil Bit

   There are a number of ways in which the evil bit may be set.  Attack
   applications may use a suitable API to request that it be set.
   Systems that do not have other mechanisms MUST provide such an API;
   attack programs MUST use it.

   Multi-level insecure operating systems may have special levels for
   attack programs; the evil bit MUST be set by default on packets
   emanating from programs running at such levels.  However, the system
   MAY provide an API to allow it to be cleared for non-malicious
   activity by users who normally engage in attack behavior.

   Fragments that by themselves are dangerous MUST have the evil bit
   set.  If a packet with the evil bit set is fragmented by an
   intermediate router and the fragments themselves are not dangerous,
   the evil bit MUST be cleared in the fragments, and MUST be turned
   back on in the reassembled packet.

   Intermediate systems are sometimes used to launder attack
   connections.  Packets to such systems that are intended to be relayed
   to a target SHOULD have the evil bit set.

   Some applications hand-craft their own packets.  If these packets are
   part of an attack, the application MUST set the evil bit by itself.

   In networks protected by firewalls, it is axiomatic that all
   attackers are on the outside of the firewall.  Therefore, hosts
   inside the firewall MUST NOT set the evil bit on any packets.



Bellovin                     Informational