Someone Rendered 'Bad Apple!!' Inside Traceroute Output Using nftables Hop Spoofing

The perennial ‘Bad Apple!!’ shadow-art animation — the de facto benchmark for improbable displays, much as Doom is for arbitrary code execution — has a new host: traceroute. Building on earlier work that injected fabricated hops into traceroute results, the author used nftables’ numgen feature to make each ICMPv6 response return a different IPv6 address on demand. A monotonic counter cycles through addresses, so a single hop can flicker through a whole sequence of values rather than resolving to one stable router.

Two obstacles had to be cleared. The Linux kernel throttles ICMPv6 replies to one per second by default, which would stall the animation almost immediately, so the rate limit was zeroed via sysctl. And mtr normally lists every distinct address it sees for a hop — genuinely useful for spotting multipath routing, but here just visual noise — so a one-line patch forces it to overwrite a single slot instead. The author notes a shell loop around plain traceroute would avoid patching, but calls that barely less of a cheat.

The pipeline itself is mundane in a way that makes the result funnier: ffmpeg resamples the clip to 8 fps and exports 30x11-pixel PNG frames, then a Python script transcodes those frames into an nftables ruleset that emits the matching ICMPv6 responses. The output is a ruleset north of a megabyte. It’s a pure novelty hack with no security payload, but it’s a neat demonstration of how far packet-mangling primitives like numgen can be pushed to fake network topology on the fly.