SANS ISC explains how to spot Multipath TCP on a network after a new Linux MPTCP flaw

Serguey Asael Shinder03 November 2026, 08:151 min read

After last week's report of a vulnerability in the Linux implementation of Multipath TCP, Johannes Ullrich of the SANS Internet Storm Center published a diary on 2 November that sets the bug aside and explains the protocol itself and how defenders can see it on their networks.

MPTCP, defined in RFC 8684, lets one logical connection run over several TCP subflows from different addresses, so a phone can move from Wi-Fi to cellular without dropping a session, and a server can fill a fast link with more than one connection. Ullrich writes that the only widely used implementation he has observed is on iOS and iPadOS, where IPv4 connections to Apple's 17.0.0.0/8 range often use it, first for Siri and later for services such as Apple Music.

The diary describes the TCP option, kind 30, and its subtypes: MP_CAPABLE in the handshake with an 8-byte key, MP_JOIN for adding a subflow, DSS for mapping each subflow's sequence numbers onto the combined stream, and ADD_ADDR and REMOVE_ADDR for advertising addresses. It notes that the RFC allows either side to open a new subflow, although the client normally does, and that ordinary firewall rules will block a server-initiated one.

What it means

The practical use for a network team is a baseline: if MPTCP options appear in traffic that does not go to Apple, that is unusual enough to look at. Whether a given Linux host is exposed to the new flaw depends on whether MPTCP is enabled in its kernel, which is a question for the distribution's advisory, not for this diary.