I wonder which version of Wireshark he was using; we've supported the evil bit since 2009.