Detecting Multipath TCP (MPTCP) Traffic in Networks

2026-11-02 17:39 UTC 5 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

MPTCP, a TCP option enabling multi-path connections, is widely used by mobile devices and Apple services.
iOS and iPadOS devices leverage MPTCP for connections to specific Apple network ranges (17.0.0.0/8).
Network defenders should implement monitoring for TCP Option 30 to identify and understand MPTCP traffic.

Understanding and Detecting Multipath TCP (MPTCP) in Networks

Multipath TCP (MPTCP), defined in RFC 8684, is a significant evolution of the traditional TCP protocol designed to enhance connection reliability and bandwidth utilization. While MPTCP recently gained attention due to a vulnerability in Linux’s implementation (CVE-2026-98432), this analysis, based on a SANS Internet Storm Center diary entry, focuses not on the vulnerability itself, but on the practical aspects of MPTCP’s functionality, its real-world applications, and, critically, how to detect Multipath TCP traffic within your network environment, as detailed by SANS ISC.

Traditional TCP connections are constrained to a single network path, meaning if a device switches its network interface (e.g., from Wi-Fi to cellular), the connection often breaks and needs to be re-established. MPTCP addresses this limitation by allowing a single logical TCP connection to utilize multiple network paths simultaneously or to seamlessly transition between them. This is particularly beneficial for mobile devices and servers that struggle to saturate high-bandwidth links with a single TCP connection due to inherent window size and sequence number range constraints.

Technical Deep Dive: How Multipath TCP Works

MPTCP extends standard TCP by introducing a new TCP Option (Option 30, or 0x1e). This option signals MPTCP capability during the TCP handshake and facilitates the management of sub-sessions across different IP addresses and potentially different ports. The protocol supports two primary versions (v0 and v1) and several key subtypes, which include:

MP_CAPABLE (Subtype 0): Used during the initial TCP handshake to indicate MPTCP support. Both client and server must exchange this option, which also carries an 8-byte key for identifying and authenticating sub-sessions.
MP_JOIN (Subtype 1): Allows a new TCP connection, potentially from a different IP address, to join an existing MPTCP connection as a subflow. While typically client-initiated, the RFC allows server-initiated joins.
DSS (Data Sequence Signal, Subtype 2): Maps the sequence numbers of individual TCP subflows to the combined MPTCP connection’s sequence space, enabling the reassembly of data from multiple paths.
ADD_ADDR/REMOVE_ADDR (Subtypes 3, 4): These options advertise or remove additional IP addresses or ports that can be used for new subflows, similar to MP_JOIN but without immediately establishing a connection.

One of the most widespread implementations of MPTCP can be found in iOS and iPadOS devices. Apple has utilized MPTCP for services like Siri and Apple Music, especially for IPv4 connections directed to Apple’s 17.0.0.0/8 IP range. Understanding these iOS/iPadOS MPTCP implementation details is crucial for accurate network baselining.

Identifying Multipath TCP (MPTCP) Traffic

Monitoring MPTCP use with network security tools is primarily achieved by looking for the presence of TCP Option 30 (0x1e) in TCP headers. Here’s how various tools can be leveraged for this:

Wireshark/tshark: These tools offer a direct display filter: mptcp. This simplifies the identification of MPTCP-enabled connections.
tcpdump: While tcpdump lacks a specific filter for TCP options, MPTCP packets, especially SYN packets, often have larger TCP headers. A general filter like tcp[12]>0xd0 can help identify potentially MPTCP-enabled connections by checking TCP header length.
Suricata: The tcp.hdr keyword in Suricata allows for inspecting TCP options. Specifically, for MP_CAPABLE options (which typically have a length of 20 bytes), look for byte patterns like 1e 14 00 for MPTCP version 0 or 1e 14 01 for version 1 at the beginning of the option field.
Snort: Snort does not provide a direct keyword for TCP options. Its snort_decoder experimental TCP option alert only triggers on options reserved for experimental use, not MPTCP’s assigned Option 30.

Zeek (Bro): Zeek provides tcp_option and tcp_options events. Users can script a simple event handler to log connections where opt == 30, indicating MPTCP usage. For example:

event tcp_option(c: connection, is_orig: bool, opt: count, optlen: count) {
    if ( opt == 30 ) {
        print(fmt("MPTCP between %s and %s", c$id$orig_h, c$id$resp_h));
    }
}

Actionable Recommendations

Implement Network Visibility: Utilize the detection methods described above to gain visibility into MPTCP traffic on your network. This is especially important for organizations with a significant number of mobile devices or those operating complex cloud environments.
Baseline Normal MPTCP Usage: Understand what constitutes normal MPTCP traffic for your environment, particularly regarding iOS/iPadOS devices communicating with Apple services. Deviations from this baseline could indicate unusual activity.
Review Firewall Rules: While MPTCP is designed to be compatible with existing firewalls, ensure that your perimeter defenses are configured to handle multiple subflows if necessary, especially if MPTCP is used for critical internal applications.
Stay Informed on MPTCP Security: Although the focus here is on detection, regularly consult security advisories regarding MPTCP implementations in various operating systems, given its increasing adoption. The Linux vulnerability mentioned (CVE-2026-98432) highlights that even mature protocols can have implementation flaws.

#iOS #iPadOS #Apple

X/Twitter LinkedIn Reddit HN

← Back to Articles