# Evil Bit Chain

This module contains the EvilChain analysis chain which can be used by PATHspider’s Observer for recording Evil Bit connectivity [RFC3514] details.

class `pathspider.chains.evil.``EvilChain`

  Field Name | Type | Meaning
  --- | --- | ---
  `evilbit_syn_fwd` | bool | True if the evil bit was set in the IP header for a TCP SYN packet in the forward direction, false otherwise
  `evilbit_syn_fwd` | bool | True if the evil bit was set in the IP header for a TCP SYN packet in the reverse direction, false otherwise
  `evilbit_data_fwd` | bool | True if the evil bit was set in the IP header for a non-TCP packet in the forward direction, false otherwise
  `evilbit_data_rev` | bool | True if the evil bit was set in the IP header for a non-TCP packet in the reverse direction, false otherwise

  `ip4`(rec, ip, rev)

    Records evil bit markings from an IPv4 header.

    Evil Bit Marking
      For either TCP_SYN packets or non-TCP or TCP with payload packets the relevant field will record whether the Evil Bit was set.

    Parameters:

    - rec (dict) – the flow record
    - ip (plt.ip) – the IPv4 packet that was observed to be part of this flow
    - rev (bool) – True if the packet was in the reverse direction, False if in the forward direction

    Returns: | Always `True`
    Return type: | bool

  `new_flow`(rec, ip)

    For a new flow, all fields will be initialised to `None`.

    Parameters:

    - rec (dict) – the flow record
    - ip (plt.ip or plt.ip6) – the IP or IPv6 packet that triggered the creation of a new flow record

    Returns: | Always `True`
    Return type: | bool