         finish_span(span, result: "tcp_rejected")
         close(state)
 
-      {:ok, _non_ssl_header_byte} when optional == :optional ->
+      {:ok, @tcp_header_byte} when optional in [:disabled, :optional] ->
         finish_span(span, result: "tcp")
         receive_message(state)
+
+      {:ok, _other_byte} ->
+        Logger.error(fn ->
+          format_log("peek_first_byte", "unknown protocol", state)
+        end)
+
+        finish_span(span, result: "unknown_protocol")
+        close(state)
 
       {:error, closed} when closed in [:closed, :econnreset, :timeout] ->
         finish_span(span, result: to_string(closed))

      {:ok, first_byte}
    end
    |> case do
      {:ok, @ssl_header_byte} ->
        finish_span(span, result: "ssl")
        ssl_handshake(ssl_opts, state)

      {:ok, _non_ssl_header_byte} when optional == :required ->
        Logger.error(fn ->
          format_log("peek_first_byte", "SSL required", state)
        end)


  @default_timeout 20_000
  @ssl_header_byte 0x16
  @tcp_header_byte 0x00

  @typedoc "A module that implements the :ranch_transport behaviour"
  @type transport :: :ranch_tcp
