17

Does wireshark have a filter for TLS's Server Name Indication field?

5 Answers 5

14

ssl.handshake.extensions_server_name

1
  • 7
    Hello Shawn E. Although this might answer the question, can you provide some additional explanations? Maybe that would be helpful for others.
    – nixda
    Jan 21, 2013 at 20:20
13

Shawn E's answer is probably the correct answer but my wireshark version doesnt have that filter. Following filters do exists, however:

To check if the SNI field exists:

ssl.handshake.extension.type == 0

or

ssl.handshake.extension.type == "server_name"

To check if an extension contains certain domain:

ssl.handshake.extension.data contains "twitter.com"
1
  • 3
    here's what worked for me: tls.handshake.extensions_server_name contains "twitter.com" Sep 13, 2019 at 4:46
6

Newer Wireshark has R-Click context menu with filters.

Find Client Hello with SNI for which you'd like to see more of the related packets.

Drill down to handshake / extension : server_name details and from R-click choose Apply as Filter.

See attached example caught in version 2.4.4

SNI-WireShark-contextFilter

2

For a more complete example, here's the command to show SNIs used in new connections:

tshark -p -Tfields -e ssl.handshake.extensions_server_name \ 
    -Y 'ssl.handshake.extension.type == "server_name"'

(This is what your ISP can easily see in your traffic.)

1

As google shows this up as first hit, the syntax has changed a bit (ssl renamed to tls):

tshark -r FILENAME.pcap -Tfields -e tls.handshake.extensions_server_name -Y 'tls.handshake.extension.type == 0'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.