There are two main reasons why you may want to exempt some traffic from mitmproxy's interception mechanism:
If you want to peek into (SSL-protected) non-HTTP connections, check out the tcp proxy feature. If you want to ignore traffic from mitmproxy's processing because of large response bodies, take a look at the response streaming feature.
command-line | --ignore regex |
---|---|
mitmproxy shortcut | I |
mitmproxy allows you to specify a regex which is matched against a host:port
string (e.g. "example.com:443")
to determine hosts that should be excluded.
There are two important quirks to consider:
If you just want to ignore one specific domain, there's usually a bulletproof method to do so:
$ mitmdump -v 127.0.0.1:50588: clientconnect 127.0.0.1:50588: request -> CONNECT example.com:443 HTTP/1.1 127.0.0.1:50588: Set new server address: example.com:443 127.0.0.1:50588: serverconnect -> example.com:443 ^C $ mitmproxy --ignore ^example\.com:443$
Here are some other examples for ignore patterns:
# Exempt traffic from the iOS App Store (the regex is lax, but usually just works): --ignore apple.com:443 # "Correct" version without false-positives: --ignore '^(.+\.)?apple\.com:443$' # Ignore example.com, but not its subdomains: --ignore '^example.com:' # Ignore everything but example.com and mitmproxy.org: --ignore '^(?!example\.com)(?!mitmproxy\.org)' # Transparent mode: --ignore 17\.178\.96\.59:443 # IP address range: --ignore 17\.178\.\d+\.\d+:443
This stems from an limitation of explicit HTTP proxying: A single connection can be re-used for multiple target domains - a GET http://example.com/
request may be followed by a GET http://evil.com/
request on the same connection. If we start to ignore the connection after the first request, we would miss the relevant second one. ↩