Tacking this on here to increase visibility.
You can see who is already listening to multipath TCP by running:
ss -Mln
running the sysctl command will prevent future ports being opened, but it will not close existing ones, you need to manually restart the services/containers.
Go applications enable the functionality in their ports by default.
My understanding is that a proper fix will come from a kernel update, since this affects plain TCP, but MPTCP has a known attack path.
You can disable multipath TCP by issuing this command
sudo sysctl -w net.mptcp.enabled=0persist across reboots with
echo "net.mptcp.enabled=0" | sudo tee /etc/sysctl.d/99-mptcp.confIf your kernel is older than 5.6 then there is no multipath TCP to disable. e.g. Ubuntu 20.04 should be fine.
Note: It’s unclear whether this is an adequate mitigation.
Tacking this on here to increase visibility.
You can see who is already listening to multipath TCP by running:
ss -Mlnrunning the sysctl command will prevent future ports being opened, but it will not close existing ones, you need to manually restart the services/containers.
Go applications enable the functionality in their ports by default.
My understanding is that a proper fix will come from a kernel update, since this affects plain TCP, but MPTCP has a known attack path.