cyber.hendryadrian.com
Detection & Defense · isc.sans.edu

How to Identify Multipath TCP in Network Traffic

· Original article ↗

Summary

A practical guide to MPTCP explains its TCP options and use, then outlines ways to detect it with Wireshark, tcpdump, Suricata, and Zeek, while noting Snort's stated limitations.

Key points

  • MPTCP can maintain a connection across multiple IP addresses, supporting network changes without re-establishing the application connection.
  • The author reports observing MPTCP in iOS/iPadOS traffic, including IPv4 connections to Apple address space.
  • TCP Option 30 identifies MPTCP; MP_CAPABLE negotiates support, while MP_JOIN adds a subflow and DSS maps subflow sequence numbers.
  • Wireshark and tshark can identify MPTCP with the “mptcp” display filter.
  • The article describes using Suricata's tcp.hdr keyword to inspect MPTCP options; MP_CAPABLE can include version-specific bytes.
  • The author notes tcpdump lacks a straightforward TCP-option match and Snort lacks a keyword for inspecting TCP options.
  • Zeek's tcp_option or tcp_options events can be used to log connections that use TCP Option 30.

Article Details

Defense Focus
Detect and identify Multipath TCP (MPTCP) traffic in network communications; the article discusses protocol detection, not malicious activity.
Detection Methods
  • Inspect TCP Option 30, the MPTCP option.
  • Use Wireshark's "mptcp" display filter.
  • Use TCP header length as a heuristic with tcpdump; MPTCP packets, particularly SYN packets, tend to have large TCP headers.
  • In Suricata, inspect TCP options with the "tcp.hdr" keyword; an MP_CAPABLE message carrying both keys is 20 bytes long and begins with 1e 14 00 for version 0 or 1e 14 01 for version 1.
  • Use Zeek's tcp_option or tcp_options events to identify and log option 30.
Data Sources
  • TCP packet headers and options, including Option 30
  • TCP handshake and SYN packets
  • Zeek TCP option events
Rule Types
  • Wireshark display filter
  • tcpdump TCP header-length filter expression
  • Suricata tcp.hdr keyword rule
  • Zeek tcp_option event script
Platforms
  • Wireshark
  • tcpdump
  • Suricata
  • Snort
  • Zeek
Defensive Actions
  • Monitor TCP traffic for Option 30 to identify MPTCP connections.
  • Use a packet analyzer or IDS that can inspect TCP options; the article notes that Snort lacks a keyword for inspecting them.
  • When using tcpdump, treat large TCP headers as a heuristic rather than a direct match for MPTCP.

Tools

SnortSnort: Snort does not have a keyword to inspect TCP options, and as far as I know, no way to filter for multipath TCP.SuricataSuricata: Use the "tcp.hdr" keyword to inspect TCP options.tcpdumptcpdump: There is no great way to match TCP options in tcpdump.WiresharkWireshark/tshark: Wireshark has a "mptcp" display filter keyword.ZeekZeek: By default, zeek does not log options, but it does offer the tcp_option and tcp_options events that can easily be used to log MPTCP.

Related Articles