Comment by avidiax

Even with encryption turned on, there will be plaintext packets you must process (e.g. to start the session). So it requires a whitelist to properly enforce, but all your conformance tests will pass without it. Easy to miss.