Tacking this on here to increase visibility.
You can see who is already listening to multipath TCP by running:
ss -Mln
running the sysctl command will prevent future ports being opened, but it will not close existing ones, you need to manually restart the services/containers.
Go applications enable the functionality in their ports by default.
My understanding is that a proper fix will come from a kernel update, since this affects plain TCP, but MPTCP has a known attack path.
You can disable multipath TCP by issuing this command
sudo sysctl -w net.mptcp.enabled=0persist across reboots with
echo "net.mptcp.enabled=0" | sudo tee /etc/sysctl.d/99-mptcp.confIf your kernel is older than 5.6 then there is no multipath TCP to disable. e.g. Ubuntu 20.04 should be fine.
Tacking this on here to increase visibility.
You can see who is already listening to multipath TCP by running:
ss -Mlnrunning the sysctl command will prevent future ports being opened, but it will not close existing ones, you need to manually restart the services/containers.
Go applications enable the functionality in their ports by default.
My understanding is that a proper fix will come from a kernel update, since this affects plain TCP, but MPTCP has a known attack path.
Note: It’s unclear whether this is an adequate mitigation.