Multipath TCP: Breaking Today's Networks with Tomorrow's Protocols
summary
Multipath TCP extends TCP so one logical connection uses multiple TCP subflows and can change IP mid-session, and that lets the packet sender split a payload across five streams so an IDS like Snort sees only fragments and misses alerts. Live demo uses a Linux MPTCP stack and a custom fragmentor (GitHub) to evade detection; a scanner and cheat sheet and scanner on GitHub verify true MPTCP support versus mere option echoing. Mitigations shown: strip TCP option 30 with iptables/Cisco or terminate MPTCP at a proxy, but reassembly requires capturing the initial plaintext handshake keys so inline inspection is nontrivial.
AI-written summary · about
chapters (7)
- 0:00Introduction to MPTCP
- 21:24Security implications
- 24:44Firewall and network impact
- 27:44Defensive strategies
- 32:02Future research and challenges
- 37:14Conclusions and Q&A
- 39:27Audience Q&A
related talks
28mMultipath TCP hands-on on Fedora
54mHow to [not] implement a [not so] new net protocol
32mMPTCP: Extending kernel functionality with eBPF and Netlink
24mExtending packetdrill to test MPTCP
15mHA/TCP: A Reliable and Scalable Framework for TCP Network Functions
14mMTP: Transport for In-Network Computing
29mNetwork Fault Finding System: Packet Loss Triangulation
20mPostMan: Rapidly Mitigating Bursty Traffic by Offloading Packet Processing