Comment by majorchord
2 days ago
Thankfully the vast majority of servers are not creating MPTCP listeners by default (that I'm aware of).
Not sure why the article doesn't mention it, but you can specifically check for MPTCP listeners using `ss -M`.
2 days ago
Thankfully the vast majority of servers are not creating MPTCP listeners by default (that I'm aware of).
Not sure why the article doesn't mention it, but you can specifically check for MPTCP listeners using `ss -M`.
https://go.dev/doc/go1.24
> ListenConfig now uses MPTCP by default on systems where it is supported (currently on Linux only).
This seems to imply basically any golang server built since February 2025 is going to be at least attempting to use it.
Yeah seems you're right...
Luckily though, ListenConfig lets you override this https://cs.opensource.google/go/go/+/refs/tags/go1.27.3:src/...
You need `ss -Ml` if your server isn't actively serving MPTCP clients.
I was vulnerable myself by using Caddy (although MPTCP is not a prerequisite).
mptpcp usage is not a prerequisite
Do you have a source for this claim?
Everyone who’s read the patch.
Want a big name? RedHat.
1 reply →