Detecting Multipath TCP (MPTCP) Traffic in Networks
Explore Multipath TCP (MPTCP) protocol details, common implementations in iOS/iPadOS, and practical methods for network detection using Wireshark, Suricata, and Zeek.
- MPTCP, a TCP option enabling multi-path connections, is widely used by mobile devices and Apple services.
- iOS and iPadOS devices leverage MPTCP for connections to specific Apple network ranges (17.0.0.0/8).
- Network defenders should implement monitoring for TCP Option 30 to identify and understand MPTCP traffic.