Skip to content
NewA calmer, faster ZeroHour
Researchinfo

MPTCP TCP option detection methods described

Original title: Mutipath TCP: Use and Detection, (Mon, Nov 2nd)

SANS Internet Storm Center ()3 min read1
Read at isc.sans.edu
Part of a story covered by 9 sourcesLinux Kernel CVE-2026-98432 TCP use-after-free enables RCE on MPTCPMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

MPTCP uses TCP option 30 for multi-path connections and can be detected with Wireshark or tcpdump.

The SANS Internet Storm Center discusses multipath TCP and its detection. MPTCP allows splitting connections across different IP addresses. The option is commonly used by iOS devices to Apple services. Detection is done by looking for TCP option 30 with specific subtypes for version 0 or 1.

Key facts
  • MPTCP introduced in 2020 with TCP option 0x1e
  • Commonly used by iOS/iPadOS for Apple services like Siri
  • Subtypes include MP_CAPABLE, MP_JOIN, DSS, ADD_ADDR
  • Detected by checking TCP header length or specific option bytes
Security assessment · AI, from the articleNo known exploitation

Impact: potential multi-path connection manipulation

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
CVEs
CVE-2026-98432
Tags
mptcptcpdetectionapple

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-98432
Use-after-free in Linux kernel IPv4 TCP options
9.8<1%PoC ×25

From the original article

3 min read at isc.sans.edu

Last week, an often-ignored&#;x26;#;xc2;&#;x26;#;xa0;TCP option, introduced in 2020, made the news due to a new vulnerability in Linux&#;x26;#;39;s implementation (RFC&#;x26;#;xc2;&#;x26;#;xa0;8684, &#;x26;#;xc2;&#;x26;#;xa0;CVE-2026-98432)

SANS Internet Storm Center

isc.sans.edu

Read the full article at SANS Internet Storm Center

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.