id: tcp-block-non-printable-threshold
name: Block binary-noise threshold
protocol: tcp
description: Blocks client messages with an excessive amount of non-printable bytes.
category: tcp
family: tcp-hardening
tags:
- non-printable
- binary-noise
- tcp
- block
action: block
summary: Blocks client messages with an excessive amount of non-printable bytes.
behavior: Treats unusually binary-heavy client payloads as suspicious, logs the ratio,
  and closes the flow when the threshold is exceeded.
source_url: https://docs.mitmproxy.org/stable/addons/examples/
code: |
  import logging

  from mitmproxy import tcp

  NON_PRINTABLE_RATIO = 0.35


  def tcp_message(flow: tcp.TCPFlow) -> None:
      message = flow.messages[-1]
      if not message.from_client or not message.content:
          return
      non_printable = sum(
          1
          for byte in message.content
          if byte < 0x20 and byte not in {0x09, 0x0a, 0x0d}
      )
      ratio = non_printable / len(message.content)
      if ratio > NON_PRINTABLE_RATIO:
          logging.warning(
              "[tcp-block-non-printable-threshold] blocked ratio=%.2f size=%d",
              ratio,
              len(message.content),
          )
          message.drop()
          flow.kill()