So for a security related application I'm writing, I actually want to use RFC3514 ("The Evil Bit") to determine what set of traffic across the network is evil or not at a per packet level. This is used as training data for an assisted machine learning engine, so the app has to know before hand what packets are evil and which are not.
This ought to be fairly simple, it's just setting a single IP layer bit. I've tried looking into doing this with iptables or libpcap, but either they don't have the functionality or I failed to discover it.
Being able to set it for all traffic out of a machine would be fine, but filters on what comes out would be better. (Like being able to specify what higher layer protocols get it set, etc...)
I'm using Ubuntu, as well. So Linux solutions preferred. But otherwise, it doesn't really matter what method is used to accomplish this. Bash script, c/c++ app, setting some sysctl, whatever.