19

Does wireshark have a filter for TLS's Server Name Indication field?

5 Answers 5

18

Shawn E's answer is probably the correct answer but my wireshark version doesnt have that filter. Following filters do exists, however:

To check if the SNI field exists:

ssl.handshake.extension.type == 0

or

ssl.handshake.extension.type == "server_name"

To check if an extension contains certain domain:

ssl.handshake.extension.data contains "twitter.com"
1
  • 6
    here's what worked for me: tls.handshake.extensions_server_name contains "twitter.com" Sep 13, 2019 at 4:46
16

ssl.handshake.extensions_server_name

1
  • 8
    Hello Shawn E. Although this might answer the question, can you provide some additional explanations? Maybe that would be helpful for others.
    – nixda
    Jan 21, 2013 at 20:20
7

Newer Wireshark has R-Click context menu with filters.

Find Client Hello with SNI for which you'd like to see more of the related packets.

Drill down to handshake / extension : server_name details and from R-click choose Apply as Filter.

See attached example caught in version 2.4.4

SNI-WireShark-contextFilter

2

For a more complete example, here's the command to show SNIs used in new connections:

tshark -p -Tfields -e ssl.handshake.extensions_server_name \ 
    -Y 'ssl.handshake.extension.type == "server_name"'

(This is what your ISP can easily see in your traffic.)

2

As google shows this up as first hit, the syntax has changed a bit (ssl renamed to tls):

tshark -r FILENAME.pcap -Tfields -e tls.handshake.extensions_server_name -Y 'tls.handshake.extension.type == 0'

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .