[H8crilA]

It's extremely intuitive. You're trying to filter unusual, encrypted traffic.

First rule exploits the IND-CPA property of most encryption. You want to kill traffic that has about 4 bits set to 1 per byte, i.e. traffic that "looks random".

The following rules are exemptions for permissible encrypted or compressed traffic (note that compression, while not IND-CPA, results in high entropy and thus will trigger the first rule).

This could work very well, which is confirmed by the researchers in this paper.

[nerdbert]

Cool, I'll just base32 my encrypted traffic and sail through!

[H8crilA]

Yep, or simply add "GET " in front of it. Best add it in front of all packets.

[JPLeRouzic]

Thanks for the information, it is very interesting.