Multipath TCP detection: what defenders can see on the network
A SANS diary explains how Multipath TCP appears in packet inspection and why identifying the protocol differs from detecting an exploit.
Multipath TCP allows a logical connection to use multiple underlying network paths. A recent SANS Internet Storm Center diary uses renewed attention to the protocol to explain what defenders can identify in network traffic.
The protocol can support changes between network interfaces, such as a mobile device moving from Wi-Fi to a cellular connection. Instead of re-establishing the application connection for each path change, Multipath TCP allows related traffic to use different addresses.
The diary describes packet inspection using Wireshark and discusses the visibility available in other network-analysis tools. Its focus is recognizing Multipath TCP options and understanding how related connections fit together, rather than demonstrating exploitation.
Wireshark has an MPTCP display filter. The diary also discusses TCP-header inspection in tcpdump, Suricata's TCP-header keyword, limitations in Snort's option inspection, and events available in Zeek. The examples focus on identifying protocol traffic.
Sources
- Mutipath TCP: Use and Detection, (Mon, Nov 2nd)SupportingSANS Internet Storm Center
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning