Mutipath TCP: Use and Detection - SANS Internet Storm Center
Our summary
A recently disclosed flaw in Linux's multipath TCP (MPTCP) implementation, tracked as CVE-2026-98432 and tied to RFC 8684, has drawn fresh attention to a protocol feature most network defenders rarely examine. Rather than dissect the bug itself, a SANS Internet Storm Center diary uses the moment to explain what MPTCP is and how to spot it on the wire. MPTCP lets a single TCP connection be split across multiple IP paths, which is useful for mobile devices switching between Wi-Fi and cellular and for servers aggregating bandwidth across several TCP streams; the clearest real-world adopter is iOS/iPadOS, which uses it for Apple services like Siri and Apple Music over Apple's 17.0.0.0/8 address space. The diary breaks down the MPTCP option types (MP_CAPABLE, MP_JOIN, DSS, ADD_ADDR/REMOVE_ADDR, TCP option 30) and gives concrete detection tips for Wireshark, tcpdump, Suricata and Zeek, noting that Snort currently lacks a way to filter for it — information that matters for anyone tuning network monitoring to catch MPTCP traffic or related exploitation attempts.
Below is the opening; the full story is at SANS Internet Storm Center.
From SANS Internet Storm Center
Last week, an often-ignored TCP option, introduced in 2020, made the news due to a new vulnerability in Linux's implementation (RFC 8684, CVE-2026-98432)
Instead of looking at the vulnerability, I am using this diary to talk a bit about multipath TCP (MPTCP) and how you may see it used in your network.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.