Share this post on:

Sometimes it is needed to capture the SNI = server name indication. This information is encapsulated in client’s SSL Hello message.

To filter SNI in pcap file:

ip.addr == 20.108.184.198 && ssl.handshake.extension.type == 0

Example:

Leave a Comment

Your email address will not be published. Required fields are marked *