MultiPath TCP (MPTCP) RFC6824 Wifi Offloading (4G LTE)

MPTCP is a new experimental protocol from 2013 = I do not think many have, myself included.

However, i did read the RFC https://tools.ietf.org/html/rfc6824

Wireshark seem to have support for parts of MPTCP
https://www.wireshark.org/docs/dfref/m/mptcp.html

(Though i'd use TShark -T fields -e fieldname to dump the fields of the protocol to a textfile.)

The protocol itself reveals what IP addresses that are part of the transfer (ADD_ADDR and REMOVE_ADDR) and the substreams that are opened up. If you can get this info, you can reconstruct (watch out for retransmits - which are also advertised).

ADD_ADDR
https://tools.ietf.org/html/rfc6824#section-3.4.1

REMOVE_ADDR
https://tools.ietf.org/html/rfc6824#section-3.4.2

You could probably also reconstruct with the Subflow tokens too since they are described as "Connection ID".
https://tools.ietf.org/html/rfc6824#page-6

My first alternative to reconstructing data would be to to focus on the hosts (sender and receiver) by trying to determine the network data to see what is being transferred (if not encrypted - which the RFC does leave open), then do investigation on both sides - if the data warrants it.

For future reference

https://tools.ietf.org/html/rfc6824#section-3.6

Looks like it can be attacked to revert back to single flow TCP which could be useful in an investigation. Though it could possible be detectable by the person(s) who are being investigated. I'm guessing it could also be possible to physically disconnect the network a flow uses to make it singleflow. Or faking RST, FIN or the specific DATA_FIN packets if possible/allowed.

Wish you good luck.

Thank you, great analysis. The case is more complex. The connection to the cloud service provider was running over Wifi Offloading (mobile com cell pulls the connection to a Small Cell (Wifi) to make free space on the cell). The Virtual Mobile Network Operator (VMNO) is somehow unable to get the logs from the (physical) MNO. As the endpoint device is missing, but data of the cloud provider indicates that MPTCP was in use, we fight. The MPTCP we actually use for more precise suspects geospatial position as cell triangulation is here for a long time but unprecise we hope for the Small Cell of the MNO to give us information about location. Forensic data for precise location timeline lookup. Pure fun as heavy complex -)

WP about LTE wlan offloading here
LTE wlan offloading

Found a presentation about Robust Session Management of MPTCP, you may like to overfly

https://datatracker.ietf.org/meeting/99/materials/slides-99-mptcp-a-proposal-for-mptcp-robust-session-establishment-mptcp-robe