Tacking this on here to increase visibility.
You can see who is already listening to multipath TCP by running:
ss -Mln
running the sysctl command will prevent future ports being opened, but it will not close existing ones, you need to manually restart the services/containers.
Go applications enable the functionality in their ports by default.
My understanding is that a proper fix will come from a kernel update, since this affects plain TCP, but MPTCP has a known attack path.
Tacking this on here to increase visibility.
You can see who is already listening to multipath TCP by running:
ss -Mlnrunning the sysctl command will prevent future ports being opened, but it will not close existing ones, you need to manually restart the services/containers.
Go applications enable the functionality in their ports by default.
My understanding is that a proper fix will come from a kernel update, since this affects plain TCP, but MPTCP has a known attack path.